diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml index 928cd248..21037cb1 100644 --- a/.github/workflows/on-pr.yml +++ b/.github/workflows/on-pr.yml @@ -3,6 +3,10 @@ on: pull_request: types: ['opened', 'edited', 'reopened', 'synchronize'] +permissions: + id-token: write # required for OIDC + contents: read + env: CONTENTFUL_ACCESS_TOKEN: ${{ secrets.CONTENTFUL_ACCESS_TOKEN }} NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }} @@ -27,13 +31,14 @@ jobs: node-version: '18' cache: pnpm cache-dependency-path: 'pnpm-lock.yaml' - - name: Set .npmrc - run: | - echo "@lg-private:registry=https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/" >> .npmrc - echo "//artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/:_auth=${JFROG_AUTH}" >> .npmrc - echo "always-auth=true" >> .npmrc - env: - JFROG_AUTH: ${{ secrets.JFROG_AUTH }} + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: arn:aws:iam::271346171620:role/aws-codeartifact-design-github-actions + aws-region: us-east-1 + + - name: Login to CodeArtifact + run: scripts/login-codeartifact.sh - name: Install Dependencies run: pnpm install @@ -57,13 +62,14 @@ jobs: cache: pnpm cache-dependency-path: 'pnpm-lock.yaml' - - name: Set .npmrc - run: | - echo "@lg-private:registry=https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/" >> .npmrc - echo "//artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/:_auth=${JFROG_AUTH}" >> .npmrc - echo "always-auth=true" >> .npmrc - env: - JFROG_AUTH: ${{ secrets.JFROG_AUTH }} + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: arn:aws:iam::271346171620:role/aws-codeartifact-design-github-actions + aws-region: us-east-1 + + - name: Login to CodeArtifact + run: scripts/login-codeartifact.sh - name: Install Dependencies run: pnpm install @@ -85,13 +91,14 @@ jobs: cache: pnpm cache-dependency-path: 'pnpm-lock.yaml' - - name: Set .npmrc - run: | - echo "@lg-private:registry=https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/" >> .npmrc - echo "//artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/:_auth=${JFROG_AUTH}" >> .npmrc - echo "always-auth=true" >> .npmrc - env: - JFROG_AUTH: ${{ secrets.JFROG_AUTH }} + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: arn:aws:iam::271346171620:role/aws-codeartifact-design-github-actions + aws-region: us-east-1 + + - name: Login to CodeArtifact + run: scripts/login-codeartifact.sh - name: Install Dependencies run: pnpm install - name: Build NextJS diff --git a/README.md b/README.md index 19a41a15..93359b82 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,30 @@ # LeafyDocs +This project depends on private `@lg-private/*` packages, which are hosted in AWS +CodeArtifact. Authenticate once before installing: + +```bash +AWS_PROFILE=codeartifact pnpm login:codeartifact +``` + +Then: + ```bash pnpm install && pnpm dev ``` -## 401 Errors +## 401 / 403 Errors -If you encounter 401 errors during `pnpm install`, check the following: +If you encounter auth errors during `pnpm install`, your CodeArtifact token has most +likely expired — they are short-lived. Re-run `pnpm login:codeartifact` and try again. -- Ensure you are logged into Artifactory on your local machine. -- Verify that your `~/.npmrc` file includes the correct credentials and permissions. +If that doesn't help, verify your `~/.npmrc` points `@lg-private` at the CodeArtifact +registry, and that you have read access via +[this MANA group](https://mana.corp.mongodb.com/resources/683f08d01d749c007019a788). For detailed guidance, refer to the [permissions setup instructions](https://github.com/10gen/leafygreen-ui-private/blob/main/README.md#permissions). + +> Artifactory was decommissioned in 2026 — see the +> [migration page](https://wiki.corp.mongodb.com/spaces/DBDEVPROD/pages/314681038/Migration+from+Artifactory+to+AWS+CodeArtifact). +> Any lingering `JFROG_*` credentials or `artifactory.corp.mongodb.com` registry +> entries in your `~/.npmrc` can be removed. diff --git a/package.json b/package.json index a15bc02e..c8f943ba 100644 --- a/package.json +++ b/package.json @@ -14,7 +14,8 @@ "start": "next start", "lint": "eslint .", "lg": "lg", - "update-lg": "node scripts/update.mjs" + "update-lg": "node scripts/update.mjs", + "login:codeartifact": "bash scripts/login-codeartifact.sh" }, "dependencies": { "@auth/core": "^0.38.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index e9b233c7..d1bdf992 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -2506,27 +2506,27 @@ packages: '@leafygreen-ui/leafygreen-provider': ^5.0.4 '@lg-private/canvas-header@3.0.1': - resolution: {integrity: sha512-lDU/4iYT+Ms7qFnQBSP6MzJ1IdkGsS0C3uj1AdEnW1j8Dfv7ptM9ofufbdGhv32bi78mJZa2HpmInyKw/FphGA==, tarball: https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/@lg-private/canvas-header/-/@lg-private/canvas-header-3.0.1.tgz} + resolution: {integrity: sha512-lDU/4iYT+Ms7qFnQBSP6MzJ1IdkGsS0C3uj1AdEnW1j8Dfv7ptM9ofufbdGhv32bi78mJZa2HpmInyKw/FphGA==} peerDependencies: '@leafygreen-ui/leafygreen-provider': ^4.0.0 '@lg-private/cloud-nav@1.0.3': - resolution: {integrity: sha512-gGKhfTUvPfJmH2n3TXk5gg6VoA2IuBZfJ8GGdPN1YJ8HmnL/Ydvx/iiZinf3VwBENTmrsyH+n09qWNGBzXC+Yw==, tarball: https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/@lg-private/cloud-nav/-/@lg-private/cloud-nav-1.0.3.tgz} + resolution: {integrity: sha512-gGKhfTUvPfJmH2n3TXk5gg6VoA2IuBZfJ8GGdPN1YJ8HmnL/Ydvx/iiZinf3VwBENTmrsyH+n09qWNGBzXC+Yw==} peerDependencies: '@leafygreen-ui/leafygreen-provider': ^4.0.0 '@lg-private/feature-walls@4.1.1': - resolution: {integrity: sha512-mw+eZMFwITf3kSHNMaLgQCcwOQqamSjmkbBEULe2LlpSIfnoASvWUurzK3h42AJNYEHy8QnPDxG5AXRwSBPt8g==, tarball: https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/@lg-private/feature-walls/-/@lg-private/feature-walls-4.1.1.tgz} + resolution: {integrity: sha512-mw+eZMFwITf3kSHNMaLgQCcwOQqamSjmkbBEULe2LlpSIfnoASvWUurzK3h42AJNYEHy8QnPDxG5AXRwSBPt8g==} peerDependencies: '@leafygreen-ui/leafygreen-provider': ^4.0.0 '@lg-private/product-icon@3.0.1': - resolution: {integrity: sha512-rQH6lreLs7PotZ2+32XViLtddG1ckhqTKDRKMeub8WSjSOQrJOymIgqNYJQq5aVR8AP2RA54ZqEaZFQ85TT1/w==, tarball: https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/@lg-private/product-icon/-/@lg-private/product-icon-3.0.1.tgz} + resolution: {integrity: sha512-rQH6lreLs7PotZ2+32XViLtddG1ckhqTKDRKMeub8WSjSOQrJOymIgqNYJQq5aVR8AP2RA54ZqEaZFQ85TT1/w==} peerDependencies: '@leafygreen-ui/leafygreen-provider': ^4.0.0 '@lg-private/vertical-stepper@3.0.0': - resolution: {integrity: sha512-m/zsIKDUsjvm/i2ZXeLp6pkUIeeh3uz3bqH87ciZY1UWyfwPe2rIHVWmW93DD+Tm8FgRPEylTYQbrcRlXqUXDQ==, tarball: https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/@lg-private/vertical-stepper/-/@lg-private/vertical-stepper-3.0.0.tgz} + resolution: {integrity: sha512-m/zsIKDUsjvm/i2ZXeLp6pkUIeeh3uz3bqH87ciZY1UWyfwPe2rIHVWmW93DD+Tm8FgRPEylTYQbrcRlXqUXDQ==} peerDependencies: '@leafygreen-ui/leafygreen-provider': ^4.0.0 diff --git a/scripts/login-codeartifact.sh b/scripts/login-codeartifact.sh new file mode 100755 index 00000000..135679b5 --- /dev/null +++ b/scripts/login-codeartifact.sh @@ -0,0 +1,60 @@ +#!/bin/bash +# Based on https://docs.aws.amazon.com/codeartifact/latest/ug/npm-auth.html#configuring-npm-without-using-the-login-command +# +# Authenticates npm/pnpm against the CodeArtifact repository that hosts our +# @lg-private packages. Artifactory was decommissioned — see +# https://wiki.corp.mongodb.com/spaces/DBDEVPROD/pages/314681038/Migration+from+Artifactory+to+AWS+CodeArtifact +# +# In CI, AWS credentials come from the environment (see .github/workflows/on-pr.yml). +# Locally, run against the `codeartifact` AWS SSO profile: +# AWS_PROFILE=codeartifact pnpm login:codeartifact + +set -euo pipefail + +DOMAIN="mongodb" +DOMAIN_OWNER="271346171620" +REPOSITORY="leafygreen-ui" +SCOPE="@lg-private" + +if ! command -v aws &> /dev/null; then + echo "Error: aws CLI is not installed or not in PATH" + exit 1 +fi + +# Outside CI, refresh SSO credentials first. In CI the workflow supplies static +# credentials and `aws sso login` would fail (no browser). +if [ -z "${CI:-}" ] && [ -n "${AWS_PROFILE:-}" ]; then + echo "Logging into AWS SSO with profile $AWS_PROFILE..." + aws sso login --profile "$AWS_PROFILE" +fi + +echo "Logging into CodeArtifact repository $REPOSITORY..." + +CODEARTIFACT_AUTH_TOKEN=$(aws codeartifact get-authorization-token --domain $DOMAIN --domain-owner $DOMAIN_OWNER --query authorizationToken --output text) + +if [ -z "$CODEARTIFACT_AUTH_TOKEN" ] || [ "$CODEARTIFACT_AUTH_TOKEN" == "None" ]; then + echo "Failed to retrieve authorization token from AWS" + echo "Ensure your AWS profile is configured correctly and has access to CodeArtifact." + echo "Login to AWS in Okta to get current credentials: https://corp.mongodb.com/" + exit 1 +fi + +CODEARTIFACT_ENDPOINT_JSON=$(aws codeartifact get-repository-endpoint --domain $DOMAIN --domain-owner $DOMAIN_OWNER --repository $REPOSITORY --format npm) +CODEARTIFACT_REGISTRY=$(echo "$CODEARTIFACT_ENDPOINT_JSON" | jq -r '.repositoryEndpoint') + +if [ -z "$CODEARTIFACT_REGISTRY" ] || [ "$CODEARTIFACT_REGISTRY" == "null" ]; then + echo "Error: Failed to extract repository endpoint from AWS response" + exit 1 +fi + +# npm config keys are the registry URL without the scheme +CODEARTIFACT_REGISTRY_URI=$(echo "$CODEARTIFACT_REGISTRY" | sed 's|^https:||') + +echo "CodeArtifact Endpoint: $CODEARTIFACT_REGISTRY" + +npm config set "$SCOPE:registry=$CODEARTIFACT_REGISTRY" +npm config set "$CODEARTIFACT_REGISTRY_URI:_authToken=$CODEARTIFACT_AUTH_TOKEN" + +npm ping --registry="$CODEARTIFACT_REGISTRY" + +echo "✅ Successfully logged into CodeArtifact repository" diff --git a/src/app/template.tsx b/src/app/template.tsx index b00a42f0..e15e1e0b 100644 --- a/src/app/template.tsx +++ b/src/app/template.tsx @@ -10,6 +10,7 @@ import { Footer, UserMenu, SideNavigation, + ViaAnnouncementBanner, } from '@/components/global'; import { useMediaQuery } from '@/hooks'; import { SIDE_NAV_WIDTH } from '@/constants'; @@ -63,6 +64,7 @@ export default function Template({ children }: { children: React.ReactNode }) { `, )} > + {children}