feat(@angular/create): add support for yarn create and npm init

[alan-agius4]

With this change we add support to scaffold an Angular workspace using yarn create @angular and npm init @angular. These shortcuts support all of the ng-new options.

Closes #10339 and closes #14292

[alan-agius4]

Points to discuss:

1. should we have a snapshot build for the new package?
2. should it be yarn create angular or yarn create @angular? We do own create-angular.

[eneajaho]

yarn create angular looks cleaner and is easier to remember than using @angular.

[brandonroberts]

Seconded for yarn create angular

[chihab]

Would the result be the same as doing npx @angular/cli new ...?

[alan-agius4]

Would the result be the same as doing npx @angular/cli new ...?

Yes

[dgp1130]

I was going to chat about this in one of the triage meetings, but since we've skipped a couple times I'll just respond here.

1. should we have a snapshot build for the new package?

I don't feel too strongly about this. Any particular reasons we do / don't want a snapshot build? I get that it probably wouldn't be very useful in an unpublished context, not sure if npm init or yarn create have a means of pulling an unpublished package for testing.

2. should it be yarn create angular or yarn create @angular? We do own create-angular.

My feeling is that @angular is more "obviously secure". Most of our packages are under @angular/* so users should feel more confident that npm init @angular is a safe operation than npm init angular would. I don't think there's any guarantee that angular and create-angular are owned by the same group, so I would be much more hesitant to type npm init angular (fortunately we do own that and it is safe, but there's no way for a user to know that without looking).

We should definitely update npm init angular to at least fail with a clear message and suggest using npm init @angular since that is a very easy mistake to make.

[dgp1130]

Nit: Is @latest necessary?

[alan-agius4]

Yes, for NPM this is needed as otherwise if this command was previously used, the cached binary will be used.

[alan-agius4]

I don't feel too strongly about this. Any particular reasons we do / don't want a snapshot build? I get that it probably wouldn't be very useful in an unpublished context, not sure if npm init or yarn create have a means of pulling an unpublished package for testing.

That's a good point, let's not do the snapshot build for now, if needed we can do that at a later stage.

My feeling is that @angular is more "obviously secure". Most of our packages are under @angular/* so users should feel more confident that npm init @angular is a safe operation than npm init angular would. I don't think there's any guarantee that angular and create-angular are owned by the same group, so I would be much more hesitant to type npm init angular (fortunately we do own that and it is safe, but there's no way for a user to know that without looking).

We are on the same page here.

We should definitely update npm init angular to at least fail with a clear message and suggest using npm init @angular since that is a very easy mistake to make.

I can do a quick script and just publish to NPM repo manually.

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}