Dependencies of dependencies aren't installed when both dependencies are pulled from packages.drupal.org

Migrated issue

Reported by: balsama

We have a branch of lightning that defines the D.O packager as its packagist like so:

    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.drupal.org/8"
        }
    ],

And all of it's dependencies use the D.O packager syntax for versions. E.g.:

        "drupal/core": "^8.1.0",
        "drupal/embed": "^1.0",
        "drupal/entity_embed": "^1.0",
        "drupal/media_entity": "^1.0",
        "drupal/media_entity_instagram": "^1.0",
        "drupal/media_entity_twitter": "^1.0",
        "drupal/media_entity_image": "^1.0",
        "drupal/ctools": "3.0.0-alpha26",
        "drupal/panels": "3.0.0-beta4",

That all seems to work well. Running composer install grabs all the dependencies from the new packager and builds lightning as expected.

Next, I tried pointing lightning-project (Lightning Project, not Lightning) to this new branch of lightning on github like so:

    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.drupal.org/8"
        },
        {
            "type": "vcs",
            "url": "https://github.com/acquia/lightning"
        }
    ],
...
    "require": {
        ...
        "drupal/lightning": "dev-8.x-drupal-packagist"
    },

That also worked as expected. It pulled in lightning and all of lightning's dependencies (and lightning's dependencies' dependencies for that matter).

Next I tried pushing the branch of lightning that uses D.O's packagist to D.O itself (as the 2.x branch of Lightning)... and then referenced that branch of lightning in lightning-project like so:

    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.drupal.org/8"
        }
    ],
...
    "require": {
        ...
        "drupal/lightning": "2.x-dev"
    },

This resulted in lightning being installed correctly, but all of its dependencies were missing. I did a bit more testing and, as far as I can tell, when a project has a dependency pulled from the D.O packager which has a sub-dependency also pulled from the D.O packager, the sub-dependency fails to get installed. The following chart summarizes my findings. I'm unable to test all of the possible combinations, but I've indicated which rows correspond to actual branches of lightning-project and I tested a few more (e.g. P.D.O --> GH) by using drupal-project plus a dependency on the address module.

Related issue: Issue #2728777