A js/vendor/ directory committed to the repository has no version information beyond what somebody put in the filename, and no record of where any of it came from. Composer solved this on the PHP side; Bower is the same idea for the browser, and the manifest is the point rather than the download.
{
"name": "storefront",
"private": true,
"dependencies": {
"jquery": "1.10.2",
"bootstrap": "~2.3.2",
"jquery-validation": "~1.11.1"
}
}Point .bowerrc at a directory outside the web root, add it to .gitignore, and let Grunt copy or concatenate the handful of files actually served — committing the install directory hands back exactly what the manifest was there to remove. Two things it does not do. Bower clones whole repositories, so what lands on disk includes tests, sources and documentation that will never ship, and the install is large out of proportion to what you use. And it resolves a flat dependency tree, so two packages wanting different jQuery versions produce an interactive prompt rather than a resolution, which makes an unattended build hang. Pin exact versions or a tilde range; "latest" in a manifest means the build is not reproducible.