Migrate CI from Artifactory to AWS CodeArtifact - #493
Merged
Conversation
Artifactory has been decommissioned and is returning 503s, breaking every CI job at `pnpm install` while fetching @lg-private packages. Replaces the JFROG_AUTH-based .npmrc setup in all three on-pr jobs with AWS CodeArtifact auth, mirroring the pattern already used in mongodb/leafygreen-ui and 10gen/leafygreen-ui-private. Adds scripts/login-codeartifact.sh so CI and local dev share one path. Requires AWS_CODEARTIFACT_ACCESS_KEY_ID and AWS_CODEARTIFACT_SECRET_ACCESS_KEY to be added as repo secrets before CI will pass. Ref: https://wiki.corp.mongodb.com/spaces/DBDEVPROD/pages/314681038/Migration+from+Artifactory+to+AWS+CodeArtifact
DevProd provisioned an IAM role instead of static keys. Use role-to-assume with the required id-token permission, and pass --domain-owner on the CodeArtifact calls per Vitalii's example (DEVPROD-41210).
The 5 @lg-private entries had artifactory tarball URLs baked into their resolutions, so pnpm went straight to the dead host regardless of the registry config. Removing the tarball field lets pnpm derive the URL from @lg-private:registry (now CodeArtifact) while the integrity hashes still verify the contents.
There was a problem hiding this comment.
Pull request overview
Migrates this repo’s CI and local developer workflow from the decommissioned Artifactory npm registry to AWS CodeArtifact (via GitHub Actions OIDC role assumption), and updates lockfile/docs to prevent pnpm from hard-resolving Artifactory tarball URLs.
Changes:
- Update
.github/workflows/on-pr.ymlto assume an AWS role via OIDC and run a CodeArtifact login step beforepnpm install. - Add
scripts/login-codeartifact.shand expose it viapnpm login:codeartifactfor local developer auth. - Remove Artifactory tarball URLs from affected
@lg-private/*entries inpnpm-lock.yaml, and updateREADME.mdinstructions accordingly.
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
scripts/login-codeartifact.sh |
Adds a CodeArtifact auth/login script that configures npm/pnpm registry + token. |
.github/workflows/on-pr.yml |
Switches CI auth from JFrog/Artifactory to AWS CodeArtifact via OIDC role assumption. |
pnpm-lock.yaml |
Removes baked-in Artifactory tarball URLs so pnpm derives tarballs from the configured registry. |
package.json |
Adds login:codeartifact script for local developer auth. |
README.md |
Updates developer setup and troubleshooting guidance for CodeArtifact. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+42
to
+43
| CODEARTIFACT_ENDPOINT_JSON=$(aws codeartifact get-repository-endpoint --domain $DOMAIN --domain-owner $DOMAIN_OWNER --repository $REPOSITORY --format npm) | ||
| CODEARTIFACT_REGISTRY=$(echo "$CODEARTIFACT_ENDPOINT_JSON" | jq -r '.repositoryEndpoint') |
Comment on lines
+55
to
+56
| npm config set "$SCOPE:registry=$CODEARTIFACT_REGISTRY" | ||
| npm config set "$CODEARTIFACT_REGISTRY_URI:_authToken=$CODEARTIFACT_AUTH_TOKEN" |
brucecoddington
approved these changes
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Artifactory has been decommissioned. Every CI job on this repo failed at
pnpm install:Per the migration page: brownout 10 Aug 2026, full shutdown 14 Sep 2026.
This repo is the last piece of the LeafyGreen estate still pointed at Artifactory —
mongodb/leafygreen-uiand10gen/leafygreen-ui-privateare already migrated.Changes
.github/workflows/on-pr.yml— replaced theJFROG_AUTH-basedSet .npmrcstep in all three jobs (lint,types,build) withaws-actions/configure-aws-credentials+ a CodeArtifact login step. Auth is via OIDC role assumption, not static keys — so there are no new secrets to provision. Needs theid-token: writepermission, added at the workflow level.scripts/login-codeartifact.sh(new) — resolves the CodeArtifact registry endpoint and writes npm auth config. Modelled on the equivalent scripts inleafygreen-uiandleafygreen-ui-private, so all three repos share one shape. Skipsaws sso loginwhenCIis set.pnpm-lock.yaml— the 5@lg-privateentries had Artifactory tarball URLs baked into theirresolutionmaps, so pnpm went straight to the dead host regardless of registry config. Dropped thetarball:field from those entries; pnpm now derives the URL from@lg-private:registry. Allintegrityhashes are unchanged, and CI confirms CodeArtifact's tarballs verify against them.package.json— addedpnpm login:codeartifactfor local dev.README.md— replaced the stale "log into Artifactory" instructions.@lg-privatepackages live in CodeArtifact domainmongodb(owner271346171620), repositoryleafygreen-ui.Role provisioned by DevProd under DEVPROD-41210:
arn:aws:iam::271346171620:role/aws-codeartifact-design-github-actionsTest plan
Configure AWS credentialsandLogin to CodeArtifactpass via OIDCpnpm installresolves@lg-privatefrom CodeArtifactartifactory/jfrogreferences remain under.github/or in the lockfileFollow-ups (not in this PR)
on-leafygreen-release.ymlrunspnpm installwith no registry auth at all, so it will fail the same way on@lg-private. Needs the same two steps.typesjob installs dependencies but never runstsc— it's been a no-op. Left alone to keep this PR to the infra fix.JFROG_AUTH,JFROG_EMAIL,JFROG_PASSWORD, andJFROG_USERNAMEsecrets on this repo are now dead and can be deleted.271346171620(via this MANA group); CI does not, since it uses OIDC.