From 83b10e94fab034dc3c8fbee3194212be550799f1 Mon Sep 17 00:00:00 2001
From: Adam Rasheed <adamrasheed91@gmail.com>
Date: Thu, 6 Aug 2026 13:05:02 -0700
Subject: [PATCH 1/2] UXE-626: Add Via migration banner (#491)

* UXE-626: Add Via migration banner

Adds a dismissible banner announcing the shift from LeafyGreen to Via,
linking out to the Via docs/Storybook. Content strip-down is deferred
pending Design Systems sign-off on the cut list (see UXE-626 for the
proposed list).

* UXE-626: Update banner copy and Via Storybook URL
---
 src/app/template.tsx                          |  2 +
 .../global/ViaAnnouncementBanner.tsx          | 52 +++++++++++++++++++
 src/components/global/index.ts                |  1 +
 3 files changed, 55 insertions(+)
 create mode 100644 src/components/global/ViaAnnouncementBanner.tsx

diff --git a/src/app/template.tsx b/src/app/template.tsx
index b00a42f0..e15e1e0b 100644
--- a/src/app/template.tsx
+++ b/src/app/template.tsx
@@ -10,6 +10,7 @@ import {
   Footer,
   UserMenu,
   SideNavigation,
+  ViaAnnouncementBanner,
 } from '@/components/global';
 import { useMediaQuery } from '@/hooks';
 import { SIDE_NAV_WIDTH } from '@/constants';
@@ -63,6 +64,7 @@ export default function Template({ children }: { children: React.ReactNode }) {
           `,
         )}
       >
+        <ViaAnnouncementBanner />
         {children}
         <Footer />
       </div>
diff --git a/src/components/global/ViaAnnouncementBanner.tsx b/src/components/global/ViaAnnouncementBanner.tsx
new file mode 100644
index 00000000..25fea689
--- /dev/null
+++ b/src/components/global/ViaAnnouncementBanner.tsx
@@ -0,0 +1,52 @@
+'use client';
+
+import React, { useEffect, useState } from 'react';
+import { css } from '@emotion/css';
+import Banner from '@leafygreen-ui/banner';
+import { Link } from '@leafygreen-ui/typography';
+import { spacing } from '@leafygreen-ui/tokens';
+
+const VIA_STORYBOOK_URL =
+  'https://via-storybook.ux-foundations.prod.corp.mongodb.com/';
+const DISMISSED_KEY = 'viaAnnouncementDismissed';
+
+export function ViaAnnouncementBanner() {
+  const [dismissed, setDismissed] = useState(true);
+
+  useEffect(() => {
+    setDismissed(localStorage.getItem(DISMISSED_KEY) === 'true');
+  }, []);
+
+  if (dismissed) {
+    return null;
+  }
+
+  return (
+    <Banner
+      variant="warning"
+      dismissible
+      onClose={() => {
+        localStorage.setItem(DISMISSED_KEY, 'true');
+        setDismissed(true);
+      }}
+      className={css`
+        margin-bottom: ${spacing[400]}px;
+      `}
+    >
+      <div
+        className={css`
+          font-weight: bold;
+        `}
+      >
+        IMPORTANT
+      </div>
+      LeafyGreen design system is now in maintenance mode.
+      <br />
+      For new MongoDB products and features, please use{' '}
+      <Link href={VIA_STORYBOOK_URL} target="_blank" rel="noopener noreferrer" hideExternalIcon>
+        Via
+      </Link>
+      .
+    </Banner>
+  );
+}
diff --git a/src/components/global/index.ts b/src/components/global/index.ts
index 78dfec93..5157b1ec 100644
--- a/src/components/global/index.ts
+++ b/src/components/global/index.ts
@@ -7,3 +7,4 @@ export { Search } from './Search/Search';
 export { SideNavigation } from './SideNavigation';
 export { UserMenu } from './UserMenu';
 export { PrivateContentWall } from './PrivateContentWall';
+export { ViaAnnouncementBanner } from './ViaAnnouncementBanner';

From ef162281043c6c6d2b169b5188c9ab07d79733b8 Mon Sep 17 00:00:00 2001
From: Adam Rasheed <adamrasheed91@gmail.com>
Date: Tue, 11 Aug 2026 18:09:24 +0000
Subject: [PATCH 2/2] Migrate CI from Artifactory to AWS CodeArtifact (#493)

* Migrate CI from Artifactory to AWS CodeArtifact

Artifactory has been decommissioned and is returning 503s, breaking every
CI job at `pnpm install` while fetching @lg-private packages.

Replaces the JFROG_AUTH-based .npmrc setup in all three on-pr jobs with
AWS CodeArtifact auth, mirroring the pattern already used in
mongodb/leafygreen-ui and 10gen/leafygreen-ui-private. Adds
scripts/login-codeartifact.sh so CI and local dev share one path.

Requires AWS_CODEARTIFACT_ACCESS_KEY_ID and AWS_CODEARTIFACT_SECRET_ACCESS_KEY
to be added as repo secrets before CI will pass.

Ref: https://wiki.corp.mongodb.com/spaces/DBDEVPROD/pages/314681038/Migration+from+Artifactory+to+AWS+CodeArtifact

* Switch CodeArtifact auth to OIDC role assumption

DevProd provisioned an IAM role instead of static keys. Use
role-to-assume with the required id-token permission, and pass
--domain-owner on the CodeArtifact calls per Vitalii's example
(DEVPROD-41210).

* Drop artifactory tarball URLs from lockfile

The 5 @lg-private entries had artifactory tarball URLs baked into
their resolutions, so pnpm went straight to the dead host regardless
of the registry config. Removing the tarball field lets pnpm derive
the URL from @lg-private:registry (now CodeArtifact) while the
integrity hashes still verify the contents.
---
 .github/workflows/on-pr.yml   | 49 ++++++++++++++++------------
 README.md                     | 24 +++++++++++---
 package.json                  |  3 +-
 pnpm-lock.yaml                | 10 +++---
 scripts/login-codeartifact.sh | 60 +++++++++++++++++++++++++++++++++++
 5 files changed, 115 insertions(+), 31 deletions(-)
 create mode 100755 scripts/login-codeartifact.sh

diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml
index 928cd248..21037cb1 100644
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -3,6 +3,10 @@ on:
   pull_request:
     types: ['opened', 'edited', 'reopened', 'synchronize']
 
+permissions:
+  id-token: write # required for OIDC
+  contents: read
+
 env:
   CONTENTFUL_ACCESS_TOKEN: ${{ secrets.CONTENTFUL_ACCESS_TOKEN }}
   NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
@@ -27,13 +31,14 @@ jobs:
           node-version: '18'
           cache: pnpm
           cache-dependency-path: 'pnpm-lock.yaml'
-      - name: Set .npmrc
-        run: |
-          echo "@lg-private:registry=https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/" >> .npmrc
-          echo "//artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/:_auth=${JFROG_AUTH}" >> .npmrc
-          echo "always-auth=true" >> .npmrc
-        env:
-          JFROG_AUTH: ${{ secrets.JFROG_AUTH }}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::271346171620:role/aws-codeartifact-design-github-actions
+          aws-region: us-east-1
+
+      - name: Login to CodeArtifact
+        run: scripts/login-codeartifact.sh
 
       - name: Install Dependencies
         run: pnpm install
@@ -57,13 +62,14 @@ jobs:
           cache: pnpm
           cache-dependency-path: 'pnpm-lock.yaml'
 
-      - name: Set .npmrc
-        run: |
-          echo "@lg-private:registry=https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/" >> .npmrc
-          echo "//artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/:_auth=${JFROG_AUTH}" >> .npmrc
-          echo "always-auth=true" >> .npmrc
-        env:
-          JFROG_AUTH: ${{ secrets.JFROG_AUTH }}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::271346171620:role/aws-codeartifact-design-github-actions
+          aws-region: us-east-1
+
+      - name: Login to CodeArtifact
+        run: scripts/login-codeartifact.sh
 
       - name: Install Dependencies
         run: pnpm install
@@ -85,13 +91,14 @@ jobs:
           cache: pnpm
           cache-dependency-path: 'pnpm-lock.yaml'
 
-      - name: Set .npmrc
-        run: |
-          echo "@lg-private:registry=https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/" >> .npmrc
-          echo "//artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/:_auth=${JFROG_AUTH}" >> .npmrc
-          echo "always-auth=true" >> .npmrc
-        env:
-          JFROG_AUTH: ${{ secrets.JFROG_AUTH }}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::271346171620:role/aws-codeartifact-design-github-actions
+          aws-region: us-east-1
+
+      - name: Login to CodeArtifact
+        run: scripts/login-codeartifact.sh
       - name: Install Dependencies
         run: pnpm install
       - name: Build NextJS
diff --git a/README.md b/README.md
index 19a41a15..93359b82 100644
--- a/README.md
+++ b/README.md
@@ -1,14 +1,30 @@
 # LeafyDocs
 
+This project depends on private `@lg-private/*` packages, which are hosted in AWS
+CodeArtifact. Authenticate once before installing:
+
+```bash
+AWS_PROFILE=codeartifact pnpm login:codeartifact
+```
+
+Then:
+
 ```bash
 pnpm install && pnpm dev
 ```
 
-## 401 Errors
+## 401 / 403 Errors
 
-If you encounter 401 errors during `pnpm install`, check the following:
+If you encounter auth errors during `pnpm install`, your CodeArtifact token has most
+likely expired — they are short-lived. Re-run `pnpm login:codeartifact` and try again.
 
-- Ensure you are logged into Artifactory on your local machine.
-- Verify that your `~/.npmrc` file includes the correct credentials and permissions.
+If that doesn't help, verify your `~/.npmrc` points `@lg-private` at the CodeArtifact
+registry, and that you have read access via
+[this MANA group](https://mana.corp.mongodb.com/resources/683f08d01d749c007019a788).
 
 For detailed guidance, refer to the [permissions setup instructions](https://github.com/10gen/leafygreen-ui-private/blob/main/README.md#permissions).
+
+> Artifactory was decommissioned in 2026 — see the
+> [migration page](https://wiki.corp.mongodb.com/spaces/DBDEVPROD/pages/314681038/Migration+from+Artifactory+to+AWS+CodeArtifact).
+> Any lingering `JFROG_*` credentials or `artifactory.corp.mongodb.com` registry
+> entries in your `~/.npmrc` can be removed.
diff --git a/package.json b/package.json
index a15bc02e..c8f943ba 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,8 @@
     "start": "next start",
     "lint": "eslint .",
     "lg": "lg",
-    "update-lg": "node scripts/update.mjs"
+    "update-lg": "node scripts/update.mjs",
+    "login:codeartifact": "bash scripts/login-codeartifact.sh"
   },
   "dependencies": {
     "@auth/core": "^0.38.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e9b233c7..d1bdf992 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -2506,27 +2506,27 @@ packages:
       '@leafygreen-ui/leafygreen-provider': ^5.0.4
 
   '@lg-private/canvas-header@3.0.1':
-    resolution: {integrity: sha512-lDU/4iYT+Ms7qFnQBSP6MzJ1IdkGsS0C3uj1AdEnW1j8Dfv7ptM9ofufbdGhv32bi78mJZa2HpmInyKw/FphGA==, tarball: https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/@lg-private/canvas-header/-/@lg-private/canvas-header-3.0.1.tgz}
+    resolution: {integrity: sha512-lDU/4iYT+Ms7qFnQBSP6MzJ1IdkGsS0C3uj1AdEnW1j8Dfv7ptM9ofufbdGhv32bi78mJZa2HpmInyKw/FphGA==}
     peerDependencies:
       '@leafygreen-ui/leafygreen-provider': ^4.0.0
 
   '@lg-private/cloud-nav@1.0.3':
-    resolution: {integrity: sha512-gGKhfTUvPfJmH2n3TXk5gg6VoA2IuBZfJ8GGdPN1YJ8HmnL/Ydvx/iiZinf3VwBENTmrsyH+n09qWNGBzXC+Yw==, tarball: https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/@lg-private/cloud-nav/-/@lg-private/cloud-nav-1.0.3.tgz}
+    resolution: {integrity: sha512-gGKhfTUvPfJmH2n3TXk5gg6VoA2IuBZfJ8GGdPN1YJ8HmnL/Ydvx/iiZinf3VwBENTmrsyH+n09qWNGBzXC+Yw==}
     peerDependencies:
       '@leafygreen-ui/leafygreen-provider': ^4.0.0
 
   '@lg-private/feature-walls@4.1.1':
-    resolution: {integrity: sha512-mw+eZMFwITf3kSHNMaLgQCcwOQqamSjmkbBEULe2LlpSIfnoASvWUurzK3h42AJNYEHy8QnPDxG5AXRwSBPt8g==, tarball: https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/@lg-private/feature-walls/-/@lg-private/feature-walls-4.1.1.tgz}
+    resolution: {integrity: sha512-mw+eZMFwITf3kSHNMaLgQCcwOQqamSjmkbBEULe2LlpSIfnoASvWUurzK3h42AJNYEHy8QnPDxG5AXRwSBPt8g==}
     peerDependencies:
       '@leafygreen-ui/leafygreen-provider': ^4.0.0
 
   '@lg-private/product-icon@3.0.1':
-    resolution: {integrity: sha512-rQH6lreLs7PotZ2+32XViLtddG1ckhqTKDRKMeub8WSjSOQrJOymIgqNYJQq5aVR8AP2RA54ZqEaZFQ85TT1/w==, tarball: https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/@lg-private/product-icon/-/@lg-private/product-icon-3.0.1.tgz}
+    resolution: {integrity: sha512-rQH6lreLs7PotZ2+32XViLtddG1ckhqTKDRKMeub8WSjSOQrJOymIgqNYJQq5aVR8AP2RA54ZqEaZFQ85TT1/w==}
     peerDependencies:
       '@leafygreen-ui/leafygreen-provider': ^4.0.0
 
   '@lg-private/vertical-stepper@3.0.0':
-    resolution: {integrity: sha512-m/zsIKDUsjvm/i2ZXeLp6pkUIeeh3uz3bqH87ciZY1UWyfwPe2rIHVWmW93DD+Tm8FgRPEylTYQbrcRlXqUXDQ==, tarball: https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/@lg-private/vertical-stepper/-/@lg-private/vertical-stepper-3.0.0.tgz}
+    resolution: {integrity: sha512-m/zsIKDUsjvm/i2ZXeLp6pkUIeeh3uz3bqH87ciZY1UWyfwPe2rIHVWmW93DD+Tm8FgRPEylTYQbrcRlXqUXDQ==}
     peerDependencies:
       '@leafygreen-ui/leafygreen-provider': ^4.0.0
 
diff --git a/scripts/login-codeartifact.sh b/scripts/login-codeartifact.sh
new file mode 100755
index 00000000..135679b5
--- /dev/null
+++ b/scripts/login-codeartifact.sh
@@ -0,0 +1,60 @@
+#!/bin/bash
+# Based on https://docs.aws.amazon.com/codeartifact/latest/ug/npm-auth.html#configuring-npm-without-using-the-login-command
+#
+# Authenticates npm/pnpm against the CodeArtifact repository that hosts our
+# @lg-private packages. Artifactory was decommissioned — see
+# https://wiki.corp.mongodb.com/spaces/DBDEVPROD/pages/314681038/Migration+from+Artifactory+to+AWS+CodeArtifact
+#
+# In CI, AWS credentials come from the environment (see .github/workflows/on-pr.yml).
+# Locally, run against the `codeartifact` AWS SSO profile:
+#   AWS_PROFILE=codeartifact pnpm login:codeartifact
+
+set -euo pipefail
+
+DOMAIN="mongodb"
+DOMAIN_OWNER="271346171620"
+REPOSITORY="leafygreen-ui"
+SCOPE="@lg-private"
+
+if ! command -v aws &> /dev/null; then
+  echo "Error: aws CLI is not installed or not in PATH"
+  exit 1
+fi
+
+# Outside CI, refresh SSO credentials first. In CI the workflow supplies static
+# credentials and `aws sso login` would fail (no browser).
+if [ -z "${CI:-}" ] && [ -n "${AWS_PROFILE:-}" ]; then
+  echo "Logging into AWS SSO with profile $AWS_PROFILE..."
+  aws sso login --profile "$AWS_PROFILE"
+fi
+
+echo "Logging into CodeArtifact repository $REPOSITORY..."
+
+CODEARTIFACT_AUTH_TOKEN=$(aws codeartifact get-authorization-token --domain $DOMAIN --domain-owner $DOMAIN_OWNER --query authorizationToken --output text)
+
+if [ -z "$CODEARTIFACT_AUTH_TOKEN" ] || [ "$CODEARTIFACT_AUTH_TOKEN" == "None" ]; then
+  echo "Failed to retrieve authorization token from AWS"
+  echo "Ensure your AWS profile is configured correctly and has access to CodeArtifact."
+  echo "Login to AWS in Okta to get current credentials: https://corp.mongodb.com/"
+  exit 1
+fi
+
+CODEARTIFACT_ENDPOINT_JSON=$(aws codeartifact get-repository-endpoint --domain $DOMAIN --domain-owner $DOMAIN_OWNER --repository $REPOSITORY --format npm)
+CODEARTIFACT_REGISTRY=$(echo "$CODEARTIFACT_ENDPOINT_JSON" | jq -r '.repositoryEndpoint')
+
+if [ -z "$CODEARTIFACT_REGISTRY" ] || [ "$CODEARTIFACT_REGISTRY" == "null" ]; then
+  echo "Error: Failed to extract repository endpoint from AWS response"
+  exit 1
+fi
+
+# npm config keys are the registry URL without the scheme
+CODEARTIFACT_REGISTRY_URI=$(echo "$CODEARTIFACT_REGISTRY" | sed 's|^https:||')
+
+echo "CodeArtifact Endpoint: $CODEARTIFACT_REGISTRY"
+
+npm config set "$SCOPE:registry=$CODEARTIFACT_REGISTRY"
+npm config set "$CODEARTIFACT_REGISTRY_URI:_authToken=$CODEARTIFACT_AUTH_TOKEN"
+
+npm ping --registry="$CODEARTIFACT_REGISTRY"
+
+echo "✅ Successfully logged into CodeArtifact repository"