[Feature]: Plugin model for post-package add

[timheuer]

NuGet Product(s) Involved

Visual Studio Package Management UI, Visual Studio Package Manager Console, dotnet.exe

The Elevator Pitch

NuGet allows for a package to be added to a project, but does not enable post-add steps. This used to exist with the model of install.ps1 but that is no longer available. There are many scenarios where this is desired, but the current solutions (msbuild targets) does not complete the experience. NuGet should make available a renewed model for post-package add configuration in some type of plugin model that enables packages to augment the experience when adding. Right now the users who only use tools like VS Package Manager UI don't get a pleasant experience when adding packages that actually require post-add steps to be meaningful and the PM UI experience doesn't expose/alert them to such. The experience does not put the developer on the path of success and in some cases it puts them into the pit of failure.

Additional Context and Details

Razor components in ASPNET are one such category here. Nearly every Razor component will follow the pattern of asking the user to do the following:

• Add the package
• Modify their _Imports.razor file to include an additional import
• Modify their index.html file to add links to the embedded CSS/JS files as a part of the component
• Modify their Program/Startup.cs files to register new DI services that may be required for the component to work

When a developer does the first step...especially in VS...they aren't guided to know the other steps are needed unless they are able to navigate successfully to the docs. Otherwise they will be in an F5 loop, change something, fail, add the other thing, fail, repeat until they find success.

Compared to something analogous like the Vue framework which when you add a UI component (akin to a Razor component), it adds the package and also enables a hook to modify what is needed. In the Vue model, you are immediately put on the path of success. Here is an example showing a new Vue app and me adding a cool UI component library...observe the end state shows that all is modified for me to be successful:

https://user-images.githubusercontent.com/4821/154180697-78863835-7ea4-473b-8fad-991780001722.mp4

Observe that the after state has all the requirements for me to be immediately successful.

Compare that to Razor+NuGet:

https://user-images.githubusercontent.com/4821/154181509-9543cc15-9283-458b-b156-f2d71e92e5e9.mp4

Observe the after state has only added the package and I still need 4 more steps to be successful but there also is no information even telling me that. I now have to modify three things and in this particular example I'll still get an error until I realize I have to add 2 more things that weren't told to me. It's just a poorer experience.

Providing a better experience for authors to enable post-install steps would enable this scenario easily and others that have already been reported.

[nkolev92]

Team Triage: Assigning to @JonDouglas

[JonDouglas]

Providing a better experience for authors to enable post-install steps would enable this scenario easily and others that have already been reported.

I think many people would agree here with the goal. We don't have a friendly experience today. You need to know MSBuild at a certain level to be successful.

What are unknowns to me right now are:

• Can we justify these experiences even for the potential security risk it brings to the ecosystem? 2022 has brought even more malware to other ecosystems through install scripts, can we take that risk?
• Does this make sense for the package manager to provide the functionality, or for a customized CLI such as the example of 'vue' which uses the underlying components of npm under the hood. (Likely using npm install scripts too)
• If we add it, how do we warn consumers that automated steps will happen on their behalf?

Let's collect upvotes to see what the community thinks about this problem as it's a hard problem to solve. If you're reading this, please 👍 or 👎 regarding how you feel about this problem and also comment below with other considerations or workflows you'd like us to explore.