Automated PR: staging to main

.github/workflows/on-pr.yml

@@ -3,6 +3,10 @@ on:
   pull_request:
     types: ['opened', 'edited', 'reopened', 'synchronize']
 
+permissions:
+  id-token: write # required for OIDC
+  contents: read
+
 env:
   CONTENTFUL_ACCESS_TOKEN: ${{ secrets.CONTENTFUL_ACCESS_TOKEN }}
   NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
@@ -27,13 +31,14 @@ jobs:
           node-version: '18'
           cache: pnpm
           cache-dependency-path: 'pnpm-lock.yaml'
-      - name: Set .npmrc
-        run: |
-          echo "@lg-private:registry=https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/" >> .npmrc
-          echo "//artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/:_auth=${JFROG_AUTH}" >> .npmrc
-          echo "always-auth=true" >> .npmrc
-        env:
-          JFROG_AUTH: ${{ secrets.JFROG_AUTH }}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::271346171620:role/aws-codeartifact-design-github-actions
+          aws-region: us-east-1
+
+      - name: Login to CodeArtifact
+        run: scripts/login-codeartifact.sh
 
       - name: Install Dependencies
         run: pnpm install
@@ -57,13 +62,14 @@ jobs:
           cache: pnpm
           cache-dependency-path: 'pnpm-lock.yaml'
 
-      - name: Set .npmrc
-        run: |
-          echo "@lg-private:registry=https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/" >> .npmrc
-          echo "//artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/:_auth=${JFROG_AUTH}" >> .npmrc
-          echo "always-auth=true" >> .npmrc
-        env:
-          JFROG_AUTH: ${{ secrets.JFROG_AUTH }}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::271346171620:role/aws-codeartifact-design-github-actions
+          aws-region: us-east-1
+
+      - name: Login to CodeArtifact
+        run: scripts/login-codeartifact.sh
 
       - name: Install Dependencies
         run: pnpm install
@@ -85,13 +91,14 @@ jobs:
           cache: pnpm
           cache-dependency-path: 'pnpm-lock.yaml'
 
-      - name: Set .npmrc
-        run: |
-          echo "@lg-private:registry=https://artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/" >> .npmrc
-          echo "//artifactory.corp.mongodb.com/artifactory/api/npm/leafygreen-ui/:_auth=${JFROG_AUTH}" >> .npmrc
-          echo "always-auth=true" >> .npmrc
-        env:
-          JFROG_AUTH: ${{ secrets.JFROG_AUTH }}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::271346171620:role/aws-codeartifact-design-github-actions
+          aws-region: us-east-1
+
+      - name: Login to CodeArtifact
+        run: scripts/login-codeartifact.sh
       - name: Install Dependencies
         run: pnpm install
       - name: Build NextJS

README.md

@@ -1,14 +1,30 @@
 # LeafyDocs
 
+This project depends on private `@lg-private/*` packages, which are hosted in AWS
+CodeArtifact. Authenticate once before installing:
+
+```bash
+AWS_PROFILE=codeartifact pnpm login:codeartifact
+```
+
+Then:
+
 ```bash
 pnpm install && pnpm dev
 ```
 
-## 401 Errors
+## 401 / 403 Errors
 
-If you encounter 401 errors during `pnpm install`, check the following:
+If you encounter auth errors during `pnpm install`, your CodeArtifact token has most
+likely expired — they are short-lived. Re-run `pnpm login:codeartifact` and try again.
 
-- Ensure you are logged into Artifactory on your local machine.
-- Verify that your `~/.npmrc` file includes the correct credentials and permissions.
+If that doesn't help, verify your `~/.npmrc` points `@lg-private` at the CodeArtifact
+registry, and that you have read access via
+[this MANA group](https://mana.corp.mongodb.com/resources/683f08d01d749c007019a788).
 
 For detailed guidance, refer to the [permissions setup instructions](https://github.com/10gen/leafygreen-ui-private/blob/main/README.md#permissions).
+
+> Artifactory was decommissioned in 2026 — see the
+> [migration page](https://wiki.corp.mongodb.com/spaces/DBDEVPROD/pages/314681038/Migration+from+Artifactory+to+AWS+CodeArtifact).
+> Any lingering `JFROG_*` credentials or `artifactory.corp.mongodb.com` registry
+> entries in your `~/.npmrc` can be removed.

package.json

@@ -14,7 +14,8 @@
     "start": "next start",
     "lint": "eslint .",
     "lg": "lg",
-    "update-lg": "node scripts/update.mjs"
+    "update-lg": "node scripts/update.mjs",
+    "login:codeartifact": "bash scripts/login-codeartifact.sh"
   },
   "dependencies": {
     "@auth/core": "^0.38.0",

scripts/login-codeartifact.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+# Based on https://docs.aws.amazon.com/codeartifact/latest/ug/npm-auth.html#configuring-npm-without-using-the-login-command
+#
+# Authenticates npm/pnpm against the CodeArtifact repository that hosts our
+# @lg-private packages. Artifactory was decommissioned — see
+# https://wiki.corp.mongodb.com/spaces/DBDEVPROD/pages/314681038/Migration+from+Artifactory+to+AWS+CodeArtifact
+#
+# In CI, AWS credentials come from the environment (see .github/workflows/on-pr.yml).
+# Locally, run against the `codeartifact` AWS SSO profile:
+#   AWS_PROFILE=codeartifact pnpm login:codeartifact
+
+set -euo pipefail
+
+DOMAIN="mongodb"
+DOMAIN_OWNER="271346171620"
+REPOSITORY="leafygreen-ui"
+SCOPE="@lg-private"
+
+if ! command -v aws &> /dev/null; then
+  echo "Error: aws CLI is not installed or not in PATH"
+  exit 1
+fi
+
+# Outside CI, refresh SSO credentials first. In CI the workflow supplies static
+# credentials and `aws sso login` would fail (no browser).
+if [ -z "${CI:-}" ] && [ -n "${AWS_PROFILE:-}" ]; then
+  echo "Logging into AWS SSO with profile $AWS_PROFILE..."
+  aws sso login --profile "$AWS_PROFILE"
+fi
+
+echo "Logging into CodeArtifact repository $REPOSITORY..."
+
+CODEARTIFACT_AUTH_TOKEN=$(aws codeartifact get-authorization-token --domain $DOMAIN --domain-owner $DOMAIN_OWNER --query authorizationToken --output text)
+
+if [ -z "$CODEARTIFACT_AUTH_TOKEN" ] || [ "$CODEARTIFACT_AUTH_TOKEN" == "None" ]; then
+  echo "Failed to retrieve authorization token from AWS"
+  echo "Ensure your AWS profile is configured correctly and has access to CodeArtifact."
+  echo "Login to AWS in Okta to get current credentials: https://corp.mongodb.com/"
+  exit 1
+fi
+
+CODEARTIFACT_ENDPOINT_JSON=$(aws codeartifact get-repository-endpoint --domain $DOMAIN --domain-owner $DOMAIN_OWNER --repository $REPOSITORY --format npm)
+CODEARTIFACT_REGISTRY=$(echo "$CODEARTIFACT_ENDPOINT_JSON" | jq -r '.repositoryEndpoint')
+
+if [ -z "$CODEARTIFACT_REGISTRY" ] || [ "$CODEARTIFACT_REGISTRY" == "null" ]; then
+  echo "Error: Failed to extract repository endpoint from AWS response"
+  exit 1
+fi
+
+# npm config keys are the registry URL without the scheme
+CODEARTIFACT_REGISTRY_URI=$(echo "$CODEARTIFACT_REGISTRY" | sed 's|^https:||')
+
+echo "CodeArtifact Endpoint: $CODEARTIFACT_REGISTRY"
+
+npm config set "$SCOPE:registry=$CODEARTIFACT_REGISTRY"
+npm config set "$CODEARTIFACT_REGISTRY_URI:_authToken=$CODEARTIFACT_AUTH_TOKEN"
+
+npm ping --registry="$CODEARTIFACT_REGISTRY"
+
+echo "✅ Successfully logged into CodeArtifact repository"

src/app/template.tsx

@@ -10,6 +10,7 @@ import {
   Footer,
   UserMenu,
   SideNavigation,
+  ViaAnnouncementBanner,
 } from '@/components/global';
 import { useMediaQuery } from '@/hooks';
 import { SIDE_NAV_WIDTH } from '@/constants';
@@ -63,6 +64,7 @@ export default function Template({ children }: { children: React.ReactNode }) {
           `,
         )}
       >
+        <ViaAnnouncementBanner />
         {children}
         <Footer />
       </div>

src/components/global/ViaAnnouncementBanner.tsx

@@ -0,0 +1,52 @@
+'use client';
+
+import React, { useEffect, useState } from 'react';
+import { css } from '@emotion/css';
+import Banner from '@leafygreen-ui/banner';
+import { Link } from '@leafygreen-ui/typography';
+import { spacing } from '@leafygreen-ui/tokens';
+
+const VIA_STORYBOOK_URL =
+  'https://via-storybook.ux-foundations.prod.corp.mongodb.com/';
+const DISMISSED_KEY = 'viaAnnouncementDismissed';
+
+export function ViaAnnouncementBanner() {
+  const [dismissed, setDismissed] = useState(true);
+
+  useEffect(() => {
+    setDismissed(localStorage.getItem(DISMISSED_KEY) === 'true');
+  }, []);
+
+  if (dismissed) {
+    return null;
+  }
+
+  return (
+    <Banner
+      variant="warning"
+      dismissible
+      onClose={() => {
+        localStorage.setItem(DISMISSED_KEY, 'true');
+        setDismissed(true);
+      }}
+      className={css`
+        margin-bottom: ${spacing[400]}px;
+      `}
+    >
+      <div
+        className={css`
+          font-weight: bold;
+        `}
+      >
+        IMPORTANT
+      </div>
+      LeafyGreen design system is now in maintenance mode.
+      <br />
+      For new MongoDB products and features, please use{' '}
+      <Link href={VIA_STORYBOOK_URL} target="_blank" rel="noopener noreferrer" hideExternalIcon>
+        Via
+      </Link>
+      .
+    </Banner>
+  );
+}

src/components/global/index.ts

@@ -7,3 +7,4 @@ export { Search } from './Search/Search';
 export { SideNavigation } from './SideNavigation';
 export { UserMenu } from './UserMenu';
 export { PrivateContentWall } from './PrivateContentWall';
+export { ViaAnnouncementBanner } from './ViaAnnouncementBanner';