Dependency semantics differ between rails-assets and bower

[hut8]

This took me forever to track down, so I apologize for the long issue. In the error logs, I often see:

Build::BowerError: Package bootstrap-3 not found
  from build/utils.rb:21:in `rescue in bower'
  from build/utils.rb:10:in `bower'
  from update_component.rb:8:in `perform'
  from sidekiq/processor.rb:75:in `execute_job'
# ... lots more

This happens with a few packages other than bootstrap-*, but that's probably the most common one. The confusing part is that I had no idea what depended on bootstrap-3, and it looks like it's impossible to figure out reverse dependencies using the Bower API.

So I made a horrible hack that does this and basically uses bower-dependency-tree to write each dependency tree of every version in rails-assets to its own file. That took about two days to run doing 6 simultaneously:.

xargs --max-procs=6 --no-run-if-empty --delimiter='\n' \
           --max-args=1 --max-lines=1 --arg-file bower-dep-cmds.txt \
           bash --verbose -c

After searching for Package bootstrap-3 not found, I found a bunch that might cause this. One was bootstrap-tagsinput#0.4.1. In that package, I see: https://github.com/bootstrap-tagsinput/bootstrap-tagsinput/blob/0.4.1/bower.json#L30

  "dependencies": {
    "jquery": "~2.1.1",
    "bootstrap-3": "bootstrap#~3.2.0",
    "bootstrap-2.3.2": "bootstrap#2.3.2",
    "angular": "~1.2.21",
    "typeahead.js": "~0.10.4",
    "jasmine": "~2.0.1",
    "rainbow": "~1.1.9"
  }

Going to the bower dependencies spec, it says that the key must be a valid name. The definition I linked to specifies that name means:

The name of the package as stored in the registry.

There is no bootstrap-3 or bootstrap-2.3.2 in the bower registry. However, this works just fine: bower install -p -F tagsinput#0.4.1 --json, which is part of what's actually executed by the rails-assets build process.

The main problem that actually causes is that after it's built, it has a dependency that will never exist:

#<Version:0x000000088a2b60> {
               :id => 29589,
     :component_id => 3146,
           :string => "0.4.1",
     :dependencies => {
                 "rails-assets-jquery" => "~> 2.1.1",
                "rails-assets-angular" => "~> 1.2.21",
                "rails-assets-jasmine" => "~> 2.0.1",
                "rails-assets-rainbow" => "~> 1.1.9",
            "rails-assets-bootstrap-3" => "~> 3.2.0",
           "rails-assets-typeahead.js" => "~> 0.10.4",
        "rails-assets-bootstrap-2.3.2" => "2.3.2"
    },
# ...

Then when someone hits the dependency endpoint with one of these broken dependencies (averaging probably once every 5 minutes), it will try to build it again. In my opinion, bower seems to disobey the semantics it defined and should be fixed, but I would like others' opinions.