title: Is bad practice to run "bower install" when deploying in production?
body: <p>I am working on an application that uses bower.js; it's the first time I use bower, so please correct me if you see anything evidently wrong in my problem description.</p>
  
  <h2>------------------------------------------------</h2>
  
  <p>Coming from a Ruby background, I expect a package manager to have a .lock file, tracked under git, that tells me exactly which are the versions currently in use. This doesn't seem to happen with bower (am I right?).</p>
  
  <p>A couple of days ago I deleted and re-cloned my repository, and ran <code>bower install</code>, thinking that such command would just install the required versions of the js components.</p>
  
  <p>Then, today I did a one-line fix in a javascript file, compiled application.js using <code>grunt watch</code>, and realised that application.js was automatically filled up with tons of new code from bower component updates I wasn't aware of.</p>
  
  <p>I found out that our bower components were under .gitignore, and that <code>bower install</code>, that I had run a few days ago, had actually updated two components without me noticing it.</p>
  
  <p>When I realised what was happening, I immediately looked into our deployment procedure, which I paste here:</p>
  
  <pre><code>bundle install --path ${SNAP_CACHE_DIR}/.bundle
  npm install -g bower grunt-cli
  bower cache clean &amp;&amp; bower install &amp;&amp; bower list
  bundle exec cap [our application name] deploy
  </code></pre>
  
  <p>Is this dangerous? Will <code>bower install</code> update all the components, that are likely not updated in my local version and are not tracked by git, ending up having completely different js code in production?</p>