Migrate Argo CD Dockerfile to use pnpm

[nmirasch]

Assisted-by: Cursor

[svghadi]

Looks good overall. The conforma failure is expected and we can get it fixed later via policy exception. We should now look into using Nexus registry as proxy. Please ping me on slack, I will share the registry details

[nmirasch]

Bootstrapping the pnpm CLI using the same npm prefetch pattern as prefetch/yarn:

Current Konflux pipeline run validations

• pnpm CLI via npm prefetch works in Konflux
• prefetch-dependencies succeeded with {"type":"npm","path":"prefetch/pnpm"} - pnpm 10.28.1 prefetched via the cluster npm proxy
• Dockerfile bootstrap worked: npm install --prefer-offline → pnpm --version → 10.28.1
• pnpm install --frozen-lockfile →succeeded UI dependencies still require network because they are not prefetched yet
• pnpm build / webpack completed successfully
• Image built and pushed to Quay

Current limitations / next steps

• hermetic: false - Hermeto does not support pnpm-lock.yaml prefetch yet (Support for pnpm package manager hermetoproject/hermeto#1251)
• UI deps (~1,198 packages) are fetched during the image build, not in prefetch-dependencies
• For full hermetic UI builds
  • Prefetch UI deps via generic-fetcher or future native Hermeto pnpm support (hermetic: true, pnpm install --offline)
  • Bundling pnpm in ubi9/nodejs-22 would only remove the CLI bootstrap step
• Nexus / registry proxy
  • CLI prefetch already used the cluster npm proxy; next step is to configure/validate Nexus for UI pnpm install traffic (~1,198 packages/build)
• Post-build checks (preflight HasLicense, shellcheck, Coverity license) failed but appear unrelated to the pnpm migration. Conforma/policy exceptions may still be needed

[nmirasch]

/retest

[nmirasch]

Hermetic pnpm for Argo CD UI is functionally working end-to-end. The PR is blocked on one Conforma policy violation (argo-ui GitHub dependency), not on Hermeto or prefetch configuration.

Conforma blocker:
resolve argo-ui GitHub source policy (sbom_spdx.allowed_package_sources), need Konflux/policy guidance or exception.