So my theory was correct, that not providing a commit id, means that it will always attempt to download it.
As for why it is happening twice, it’s not clear without investigating, but at a guess, we think it was probably written in a way where at any point where it requires the bundle, it will ensure it is local. Since usually, it would only download if it wasn’t found locally so it would typically be a very quick check, so not a problem.
I appreciate that doesn’t fully answer the question, and it may be possible that we could tidy this up but usually, it isn’t a problem, unless you’re not specifying a commit.
I would say the best thing to do it to point to specific releases or commits.