npm ci uses registry version of package even if it has resolved custom git url

What I Wanted to Do

Get correct version of the package installed, in this case we have forked the upstream package and are waiting for the pull request to be merged and would like to use or own version until that happens:

npm install # installed git@github.com:connectedcars/node-sd-notify.git
npm ci # installed https://registry.npmjs.org/sd-notify

Reproduction Steps

Add dependency with same name of package in registry but pointing to local version of package:

“sd-notify”: "git@github.com:connectedcars/node-sd-notify.git"

rm -rf node_modules

npm ci

Details

$ cat /home/tlb/.npm/_logs/2019-07-29T08_32_23_142Z-debug.log|grep sd-notify
10 silly tree ‘sd-notify’ => LogicalTree {
10 silly tree name: ‘sd-notify’,
10 silly tree address: ‘sd-notify’,
10 silly tree ‘git+ssh://git@github.com/connectedcars/node-sd-notify.git#b6b7afb8e8e5e972626677994b0ac88587995cee’,
37 silly extractTree sd-notify@2.7.2 -> /home/tlb/test/firmware/node_modules/sd-notify
85 silly tarball no local data for sd-notify@2.7.2. Extracting by manifest.
141 http fetch GET 200 https://registry.npmjs.org/sd-notify 413ms
272 http fetch GET 200 https://registry.npmjs.org/sd-notify/-/sd-notify-2.7.2.tgz 188ms
450 silly extract sd-notify@2.7.2 extracted to /home/tlb/test/firmware/node_modules/sd-notify (828ms)
451 silly extractTree bindings@1.3.0 -> /home/tlb/test/firmware/node_modules/sd-notify/node_modules/bindings
718 silly extract bindings@1.3.0 extracted to /home/tlb/test/firmware/node_modules/sd-notify/node_modules/bindings (322ms)
5575 silly buildTree linking sd-notify@2.7.2
5576 info lifecycle sd-notify@2.7.2~preinstall: sd-notify@2.7.2
5581 info lifecycle sd-notify@2.7.2~install: sd-notify@2.7.2
5582 verbose lifecycle sd-notify@2.7.2~install: unsafe-perm in lifecycle true
5583 verbose lifecycle sd-notify@2.7.2~install: PATH: /usr/lib/node_modules/npm/node_modules/npm-lifecycle/node-gyp-bin:/home/tlb/test/firmware/node_modules/sd-notify/node_modules/.bin:/home/tlb/test/firmware/node_modules/.bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
5584 verbose lifecycle sd-notify@2.7.2~install: CWD: /home/tlb/test/firmware/node_modules/sd-notify
5585 silly lifecycle sd-notify@2.7.2~install: Args: [ ‘-c’, ‘node-gyp rebuild’ ]
5586 silly lifecycle sd-notify@2.7.2~install: Returned: code: 0 signal: null
5587 info lifecycle sd-notify@2.7.2~postinstall: sd-notify@2.7.2

Platform Info

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 18.04.2 LTS
Release: 18.04
Codename: bionic

$ npm --versions
{ '@connectedcars/firmware': '1.0.0',
  npm: '6.10.2',
  ares: '1.15.0',
  brotli: '1.0.7',
  cldr: '35.1',
  http_parser: '2.8.0',
  icu: '64.2',
  modules: '64',
  napi: '4',
  nghttp2: '1.34.0',
  node: '10.16.0',
  openssl: '1.1.1b',
  tz: '2019a',
  unicode: '12.1',
  uv: '1.28.0',
  v8: '6.8.275.32-node.52',
  zlib: '1.2.11' }
$ node -p process.platform
linux