`--without` and “Gems in at least one non-excluded group will still be installed” at odds with PLOS

Evening,

This is from the docs on groups:

Gems in at least one non-excluded group will still be installed

Forgive me for being somewhat philosophical, but I struggle to think of an occasion where I know the context and explicitly wish to exclude something, and it is then included because of some part of the context. If I say I don't eat meat, I really don't care if you serve me Indian food or Chinese food with meat in it, I don't want it. I don't care if it comes with veg or fruit, I don't want it.

This extends to tech, the authorisation for accessing files on a filesystem or tables in a database - it doesn't matter if you're in the Sales team and they have access, if you've been explicitly excluded then you don't get access.

Yet Bundler is going against explicitly requested exclusion and given what I've written above, goes against PLOS. If I have the following Gemfile and the --without development my Gemfile.lock will include coffee-script (expected) and my gems will include coffee-script (completely unexpected). I confirmed this is the case both Bundler v2.0.1 and v1.16.1.

group :web, :production do
  gem "sinatra"
  gem "haml"
end

group :assets, :development do
  gem "coffee-script"
end

This has knock on effects as I try to find a way around it. My specific need right now is to create a template Docker install that runs bundle install --without… so this is stopping me. My next move was to use ENV vars but as the Gemfile.lock needs to be updated I have to remember to run an install with the production ENV vars set to update the lock file or there'll be errors (there are errors). I've considered creating a separate production lock file or not copying the lock file over (that seems really bad) or perhaps some convoluted wrapper script, and there are many other workarounds I can use but it all boils down to, what I find to be, a strange choice.

I've looked through the docs and the source and can't find any explanation for this decision.

My 2/3 suggestions are:

1. An explicit exclusion is just that, an exclusion regardless of a gem's inclusion in another group.
2. The Gemfile.lock has separate sections for production/deployment and development (and possibly test or more).
3. Or, a Gemfile.lock.production etc is generated.

These suggestions do not, I believe, conflict with the stated core goal of Bundler

The entire point of bundler is a consistent set of gem versions

and from the same conversation

Bundler's core function is to resolve the graph of gem dependencies, and that is impossible without every gemspec.

An entire graph per environment would still be generated. The --without switch would simply not install gems. Everything would be the same except my surprise at finding extra gems installed. Either way, suggestion (1) is the main thing, not to install that which has been explicitly requested not to be.

I've no idea if this should be an RFC.

Thanks for your time.

Regards,
iain

Start with the groups documentation and the reported bundle install --without behavior using the provided Gemfile and Gemfile.lock example. Compare the documented rule with the three proposed approaches, then determine which behavior or documentation change is intended. Done means the selected approach is agreed and its effect on installed gems and lockfiles is verified.