fix(create): disable sandbox on MacOS by default in new projects

This trades-off performance for correctness, and might not be wise because
missing dependencies give non-hermetic behavior.
See bazelbuild/bazel#8230 (comment)

Also fix the default npm publish tag which cost me time in tonights release

common.bazelrc

@@ -57,6 +57,13 @@ run:debug --define=VERBOSE_LOGS=1 -- --node_options=--inspect-brk
 # The following option will change the build output of certain rules such as terser and may not be desirable in all cases
 build:debug --compilation_mode=dbg
 
+# Allow bazelrc to have configs that enable automatically on certain platform
+build --enable_platform_specific_config
+# ... and use it to turn off sandboxing on Mac by default
+# because it's slow: https://github.com/bazelbuild/bazel/issues/8230
+# Syntax, see https://blog.bazel.build/2019/06/19/list-strategy.html
+build:macos --spawn_strategy=worker,local
+
 # Turn off legacy external runfiles
 # This prevents accidentally depending on this feature, which Bazel will remove.
 build --nolegacy_external_runfiles

scripts/publish_release.sh

@@ -11,7 +11,7 @@ set -u -e -o pipefail
 # $ npm login --registry https://wombat-dressing-room.appspot.com
 
 readonly NPM_COMMAND=${1:-publish}
-readonly NPM_TAG=${2:-next}
+readonly NPM_TAG=${2:-latest}
 readonly BAZEL_BIN=./node_modules/.bin/bazel
 
 # Use a new output_base so we get a clean build