Nothing like _actually_ testing code to find the bugs

refs lerna#1033

src/Package.js

@@ -12,6 +12,7 @@ function shallowCopy(json) {
   return Object.keys(json).reduce((obj, key) => {
     const val = json[key];
 
+    /* istanbul ignore if */
     if (Array.isArray(val)) {
       obj[key] = val.slice();
     } else if (val && typeof val === "object") {
@@ -111,11 +112,20 @@ class Package {
           if (result.registry) {
             // a version (1.2.3) or range (^1.2.3)
             depCollection[depName] = `${savePrefix}${depVersion}`;
-          } else if (result.type === "git") {
+
+            return;
+          }
+
+          /* istanbul ignore else */
+          if (result.gitCommittish) {
+            // a git url with matching committish (#v1.2.3)
             const [tagPrefix] = /^\D*/.exec(result.gitCommittish);
 
+            // update committish
             result.hosted.committish = `${tagPrefix}${depVersion}`;
-            depCollection[depName] = result.hosted.toString({ noCommittish: false });
+
+            // always serialize the full git+ssh url (identical to previous result.saveSpec)
+            depCollection[depName] = result.hosted.sshurl({ noGitPlus: false, noCommittish: false });
           }
         },
       },

src/PackageGraph.js

@@ -110,7 +110,7 @@ class PackageGraph extends Map {
 
     const satisfies = forceLocal
       ? () => true
-      : (version, resolved) => semver.satisfies(version, resolved.fetchSpec || resolved.gitCommittish);
+      : (version, resolved) => semver.satisfies(version, resolved.gitCommittish || resolved.fetchSpec);
 
     this.forEach((currentNode, currentName) => {
       const { graphDependencies } = currentNode;

test/PublishCommand.js

@@ -1027,6 +1027,42 @@ describe("PublishCommand", () => {
     expect(updatedPackageVersions(testDir)).toMatchSnapshot();
   });
 
+  describe("with git-hosted sibling dependencies", () => {
+    it("updates gitCommittish versions as sshurls", async () => {
+      const testDir = await initFixture("PublishCommand/git-hosted-sibling-deps");
+
+      await lernaPublish(testDir)("--cd-version", "minor", "--exact");
+
+      expect(updatedPackageVersions(testDir)).toMatchSnapshot();
+
+      // package-1 doesn't have any dependencies
+      expect(updatedPackageJSON("package-2").dependencies).toMatchObject({
+        "package-1": "git+ssh://git@github.com/user/package-1.git#v1.1.0",
+      });
+      expect(updatedPackageJSON("package-3").devDependencies).toMatchObject({
+        "package-2": "git+ssh://git@github.com/user/package-2.git#v1.1.0",
+      });
+      expect(updatedPackageJSON("package-4").dependencies).toMatchObject({
+        "package-1": "github:user/package-1#v0.0.0", // non-matching semver
+      });
+      expect(updatedPackageJSON("package-5").dependencies).toMatchObject({
+        "package-1": "git+ssh://git@github.com/user/package-1.git#v1.1.0",
+      });
+    });
+
+    it("throws an error when --exact is missing", async () => {
+      expect.assertions(1);
+
+      const testDir = await initFixture("PublishCommand/git-hosted-sibling-deps");
+
+      try {
+        await lernaPublish(testDir)("--cd-version", "minor");
+      } catch (err) {
+        expect(err.message).toMatch("Please make sure you publish with --exact");
+      }
+    });
+  });
+
   describe("with relative file: specifiers", () => {
     beforeEach(() => {
       GitUtilities.hasTags.mockReturnValueOnce(true);

test/__snapshots__/PublishCommand.js.snap

@@ -529,6 +529,16 @@ Object {
 }
 `;
 
+exports[`PublishCommand with git-hosted sibling dependencies updates gitCommittish versions as sshurls 1`] = `
+Object {
+  "packages/package-1": "1.1.0",
+  "packages/package-2": "1.1.0",
+  "packages/package-3": "1.1.0",
+  "packages/package-4": "1.1.0",
+  "packages/package-5": "1.1.0",
+}
+`;
+
 exports[`PublishCommand with relative file: specifiers falls back to existing relative version when it is not updated 1`] = `
 Object {
   "packages/package-1": "1.1.0",

test/fixtures/PublishCommand/git-hosted-sibling-deps/lerna.json

@@ -0,0 +1,8 @@
+{
+  "version": "1.0.0",
+  "command": {
+    "publish": {
+      "useGitVersion": true
+    }
+  }
+}

test/fixtures/PublishCommand/git-hosted-sibling-deps/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "git-hosted-sibling-deps",
+  "description": "Recognizing sibling dependencies by gitCommittish",
+  "version": "0.0.0-lerna"
+}

test/fixtures/PublishCommand/git-hosted-sibling-deps/packages/package-1/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "package-1",
+  "version": "1.0.0"
+}

test/fixtures/PublishCommand/git-hosted-sibling-deps/packages/package-2/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "package-2",
+  "version": "1.0.0",
+  "dependencies": {
+    "package-1": "github:user/package-1#v1.0.0"
+  }
+}

test/fixtures/PublishCommand/git-hosted-sibling-deps/packages/package-3/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "package-3",
+  "version": "1.0.0",
+  "devDependencies": {
+    "package-2": "git@github.com:user/package-2#v1.0.0"
+  }
+}

test/fixtures/PublishCommand/git-hosted-sibling-deps/packages/package-4/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "package-4",
+  "version": "1.0.0",
+  "dependencies": {
+    "package-1": "github:user/package-1#v0.0.0"
+  }
+}

test/fixtures/PublishCommand/git-hosted-sibling-deps/packages/package-5/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "package-5",
+  "version": "1.0.0",
+  "dependencies": {
+    "package-1": "ssh://git@github.com:user/package-1.git#v1.0.0"
+  },
+  "private": true
+}