From c9b47407bfc2f5569d1b87c5a317cbf23524f6ec Mon Sep 17 00:00:00 2001
From: nmirasch <neus.miras@gmail.com>
Date: Thu, 11 Jun 2026 17:21:25 +0200
Subject: [PATCH 1/6] Migrate Argo CD Dockerfile to use pnpm

Assisted-by: Cursor
---
 .tekton/argocd-pull-request.yaml |  5 ++++-
 .tekton/argocd-push.yaml         |  5 ++++-
 config.yaml                      |  4 ++--
 containers/argocd/Dockerfile     | 17 ++++++-----------
 sources/argo-cd                  |  2 +-
 5 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/.tekton/argocd-pull-request.yaml b/.tekton/argocd-pull-request.yaml
index ebe7ad847..52f2b1df7 100644
--- a/.tekton/argocd-pull-request.yaml
+++ b/.tekton/argocd-pull-request.yaml
@@ -59,8 +59,11 @@ spec:
     - linux/x86_64
   - name: dockerfile
     value: containers/argocd/Dockerfile
+  # Hermeto does not support pnpm prefetch yet; UI deps are installed during the image build.
+  - name: hermetic
+    value: "false"
   - name: prefetch-input
-    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"yarn","path":"./sources/argo-cd/ui"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}, {"type":"npm","path":"prefetch/yarn"}]'
+    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}]'
   - name: git-metadata-directories
     value:
       - sources/argo-cd
diff --git a/.tekton/argocd-push.yaml b/.tekton/argocd-push.yaml
index 5e4096d00..cf9e1e4a4 100644
--- a/.tekton/argocd-push.yaml
+++ b/.tekton/argocd-push.yaml
@@ -57,8 +57,11 @@ spec:
       - '{{target_branch}}'
   - name: dockerfile
     value: containers/argocd/Dockerfile
+  # Hermeto does not support pnpm prefetch yet; UI deps are installed during the image build.
+  - name: hermetic
+    value: "false"
   - name: prefetch-input
-    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"yarn","path":"./sources/argo-cd/ui"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}, {"type":"npm","path":"prefetch/yarn"}]'
+    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}]'
   - name: git-metadata-directories
     value:
       - sources/argo-cd
diff --git a/config.yaml b/config.yaml
index 46937209d..4611fe343 100644
--- a/config.yaml
+++ b/config.yaml
@@ -29,8 +29,8 @@ sources:
     commit: fee011bc839911e119c8d774e97308222b4dfa8f
   - path: sources/argo-cd 
     url: https://github.com/argoproj/argo-cd.git
-    ref: v3.4.2
-    commit: 0dc6b1b57dd5bb925d5b03c3d09419ab9fb4225e
+    ref: master
+    commit: f5f3bf8a064956efd13eb02cc6702319ab564ed6
   - path: sources/argo-rollouts 
     url: https://github.com/argoproj/argo-rollouts.git
     ref: v1.8.3
diff --git a/containers/argocd/Dockerfile b/containers/argocd/Dockerfile
index 43c6cbcd4..15e0299de 100644
--- a/containers/argocd/Dockerfile
+++ b/containers/argocd/Dockerfile
@@ -21,25 +21,20 @@ FROM registry.access.redhat.com/ubi9/nodejs-22 AS argocd-ui
 
 USER root
 
-# Install Yarn
-WORKDIR /usr/src/app
-COPY ["prefetch/yarn/package.json", "prefetch/yarn/package-lock.json", "./"]
-RUN npm install --prefer-offline --no-progress --non-interactive
-ENV YARN="/usr/src/app/node_modules/.bin/yarn"
-RUN $YARN --version
-
 WORKDIR /usr/src/app/argo-cd/ui
 
-COPY ["sources/argo-cd/ui/package.json", "sources/argo-cd/ui/yarn.lock", "./"]
+COPY ["sources/argo-cd/ui/package.json", "sources/argo-cd/ui/pnpm-lock.yaml", "./"]
 
-RUN $YARN  install --no-progress --non-interactive --prefer-offline --network-timeout 200000 && \
-    $YARN cache clean
+RUN npm install -g corepack@0.34.6 && \
+    corepack enable && \
+    pnpm install --frozen-lockfile
 
 COPY ["sources/argo-cd/ui/", "."]
 
 ARG ARGO_VERSION=latest
 ENV ARGO_VERSION=$ARGO_VERSION
-RUN NODE_ONLINE_ENV='offline' NODE_ENV='production' $YARN build
+ARG TARGETARCH
+RUN HOST_ARCH=${TARGETARCH:-amd64} NODE_ENV='production' NODE_ONLINE_ENV='offline' NODE_OPTIONS=--max_old_space_size=8192 pnpm build
 
 ####################################################################################################
 # Argo CD Build stage which performs the actual build of Argo CD binaries
diff --git a/sources/argo-cd b/sources/argo-cd
index 0dc6b1b57..f5f3bf8a0 160000
--- a/sources/argo-cd
+++ b/sources/argo-cd
@@ -1 +1 @@
-Subproject commit 0dc6b1b57dd5bb925d5b03c3d09419ab9fb4225e
+Subproject commit f5f3bf8a064956efd13eb02cc6702319ab564ed6

From 3a3dd4d5a169370a1d3574e14f5287de2b5cd78b Mon Sep 17 00:00:00 2001
From: nmirasch <neus.miras@gmail.com>
Date: Fri, 26 Jun 2026 12:09:25 +0200
Subject: [PATCH 2/6] Bootstrap pnpm via npm prefetch like Yarn bootstrap

Assisted-by: Cursor
---
 .tekton/argocd-pull-request.yaml |  5 +++--
 .tekton/argocd-push.yaml         |  5 +++--
 containers/argocd/Dockerfile     | 11 ++++++++---
 prefetch/pnpm/README.md          | 29 +++++++++++++++++++++++++++++
 prefetch/pnpm/package-lock.json  | 30 ++++++++++++++++++++++++++++++
 prefetch/pnpm/package.json       |  7 +++++++
 6 files changed, 80 insertions(+), 7 deletions(-)
 create mode 100644 prefetch/pnpm/README.md
 create mode 100644 prefetch/pnpm/package-lock.json
 create mode 100644 prefetch/pnpm/package.json

diff --git a/.tekton/argocd-pull-request.yaml b/.tekton/argocd-pull-request.yaml
index 52f2b1df7..3a6d183b0 100644
--- a/.tekton/argocd-pull-request.yaml
+++ b/.tekton/argocd-pull-request.yaml
@@ -21,6 +21,7 @@ metadata:
         "containers/argocd/***".pathChanged() ||
         ".tekton/argocd-pull-request.yaml".pathChanged() ||
         "prefetch/rpms/ubi9/***".pathChanged() ||
+        "prefetch/pnpm/***".pathChanged() ||
         ".tekton/build-multi-platform-image.yaml".pathChanged() ||
         ".tekton/tasks/***".pathChanged()
       )
@@ -59,11 +60,11 @@ spec:
     - linux/x86_64
   - name: dockerfile
     value: containers/argocd/Dockerfile
-  # Hermeto does not support pnpm prefetch yet; UI deps are installed during the image build.
+  # Hermeto does not support pnpm-lock.yaml prefetch yet; UI deps are installed during the image build.
   - name: hermetic
     value: "false"
   - name: prefetch-input
-    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}]'
+    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}, {"type":"npm","path":"prefetch/pnpm"}]'
   - name: git-metadata-directories
     value:
       - sources/argo-cd
diff --git a/.tekton/argocd-push.yaml b/.tekton/argocd-push.yaml
index cf9e1e4a4..f3dd76a53 100644
--- a/.tekton/argocd-push.yaml
+++ b/.tekton/argocd-push.yaml
@@ -20,6 +20,7 @@ metadata:
         "containers/argocd/***".pathChanged() ||
         ".tekton/argocd-push.yaml".pathChanged() ||
         "prefetch/rpms/ubi9/***".pathChanged() ||
+        "prefetch/pnpm/***".pathChanged() ||
         "BUILD".pathChanged() ||
         ".tekton/build-multi-platform-image.yaml".pathChanged() ||
         ".tekton/tasks/***".pathChanged()
@@ -57,11 +58,11 @@ spec:
       - '{{target_branch}}'
   - name: dockerfile
     value: containers/argocd/Dockerfile
-  # Hermeto does not support pnpm prefetch yet; UI deps are installed during the image build.
+  # Hermeto does not support pnpm-lock.yaml prefetch yet; UI deps are installed during the image build.
   - name: hermetic
     value: "false"
   - name: prefetch-input
-    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}]'
+    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}, {"type":"npm","path":"prefetch/pnpm"}]'
   - name: git-metadata-directories
     value:
       - sources/argo-cd
diff --git a/containers/argocd/Dockerfile b/containers/argocd/Dockerfile
index 15e0299de..ee4a9f1d4 100644
--- a/containers/argocd/Dockerfile
+++ b/containers/argocd/Dockerfile
@@ -21,13 +21,18 @@ FROM registry.access.redhat.com/ubi9/nodejs-22 AS argocd-ui
 
 USER root
 
+# Install pnpm via npm prefetch bootstrap (same pattern as prefetch/yarn)
+WORKDIR /usr/src/app
+COPY ["prefetch/pnpm/package.json", "prefetch/pnpm/package-lock.json", "./"]
+RUN npm install --prefer-offline --no-progress --non-interactive
+ENV PATH="/usr/src/app/node_modules/.bin:${PATH}"
+RUN pnpm --version
+
 WORKDIR /usr/src/app/argo-cd/ui
 
 COPY ["sources/argo-cd/ui/package.json", "sources/argo-cd/ui/pnpm-lock.yaml", "./"]
 
-RUN npm install -g corepack@0.34.6 && \
-    corepack enable && \
-    pnpm install --frozen-lockfile
+RUN pnpm install --frozen-lockfile
 
 COPY ["sources/argo-cd/ui/", "."]
 
diff --git a/prefetch/pnpm/README.md b/prefetch/pnpm/README.md
new file mode 100644
index 000000000..5db219495
--- /dev/null
+++ b/prefetch/pnpm/README.md
@@ -0,0 +1,29 @@
+# pnpm Bootstrap via npm Prefetch
+
+Related: [GITOPS-9932](https://redhat.atlassian.net/browse/GITOPS-9932)
+
+The **Node.js base images used in Konflux do not include pnpm**.  
+Since hermetic builds cannot install tools from the network in the Dockerfile, pnpm is bootstrapped the same way as Yarn v1 in `prefetch/yarn/`:
+
+- Pin `pnpm` in `package.json` / `package-lock.json`
+- Prefetch with Hermeto `npm` during `prefetch-dependencies`
+- Install offline in the Dockerfile via `npm install --prefer-offline`
+
+Long term, pnpm should be bundled in `registry.access.redhat.com/ubi9/nodejs-22`.
+
+## Regenerate lockfile
+
+```bash
+npm --prefix prefetch/pnpm install --package-lock-only
+```
+
+## Tekton prefetch-input
+
+```json
+{"type": "npm", "path": "prefetch/pnpm"}
+```
+
+## References
+
+- Yarn bootstrap: `prefetch/yarn/README.md`
+- Example Dockerfile: `containers/argocd/Dockerfile`
diff --git a/prefetch/pnpm/package-lock.json b/prefetch/pnpm/package-lock.json
new file mode 100644
index 000000000..9a9659d4f
--- /dev/null
+++ b/prefetch/pnpm/package-lock.json
@@ -0,0 +1,30 @@
+{
+  "name": "pnpm-install",
+  "version": "10.28.1",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "pnpm-install",
+      "version": "10.28.1",
+      "dependencies": {
+        "pnpm": "10.28.1"
+      }
+    },
+    "node_modules/pnpm": {
+      "version": "10.28.1",
+      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-10.28.1.tgz",
+      "integrity": "sha512-fX27yp6ZRHt8O/enMoavqva+mSUeuUmLrvp9QGiS9nuHmts6HX5of8TMwaOIxxdfuq5WeiarRNEGe1T8sNajFg==",
+      "bin": {
+        "pnpm": "bin/pnpm.cjs",
+        "pnpx": "bin/pnpx.cjs"
+      },
+      "engines": {
+        "node": ">=18.12"
+      },
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    }
+  }
+}
diff --git a/prefetch/pnpm/package.json b/prefetch/pnpm/package.json
new file mode 100644
index 000000000..a9a3e1932
--- /dev/null
+++ b/prefetch/pnpm/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "pnpm-install",
+  "version": "10.28.1",
+  "dependencies": {
+    "pnpm": "10.28.1"
+  }
+}

From 5e26cecc767fa666e2b0e020da4d50fce1bd1298 Mon Sep 17 00:00:00 2001
From: nmirasch <neus.miras@gmail.com>
Date: Fri, 3 Jul 2026 11:38:04 +0200
Subject: [PATCH 3/6] Adding references to enable hermetic builds

Assisted-by: Cursor
---
 .tekton/argocd-pull-request.yaml |  2 +-
 .tekton/argocd-push.yaml         |  2 +-
 prefetch/pnpm/README.md          | 15 ++++++++++++++-
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/.tekton/argocd-pull-request.yaml b/.tekton/argocd-pull-request.yaml
index 3a6d183b0..3d2d48690 100644
--- a/.tekton/argocd-pull-request.yaml
+++ b/.tekton/argocd-pull-request.yaml
@@ -60,7 +60,7 @@ spec:
     - linux/x86_64
   - name: dockerfile
     value: containers/argocd/Dockerfile
-  # Hermeto does not support pnpm-lock.yaml prefetch yet; UI deps are installed during the image build.
+  # Hermeto 0.52.x x-pnpm does not download tarballs; re-enable hermetic + pnpm prefetch at 0.57.0.
   - name: hermetic
     value: "false"
   - name: prefetch-input
diff --git a/.tekton/argocd-push.yaml b/.tekton/argocd-push.yaml
index f3dd76a53..6f828e418 100644
--- a/.tekton/argocd-push.yaml
+++ b/.tekton/argocd-push.yaml
@@ -58,7 +58,7 @@ spec:
       - '{{target_branch}}'
   - name: dockerfile
     value: containers/argocd/Dockerfile
-  # Hermeto does not support pnpm-lock.yaml prefetch yet; UI deps are installed during the image build.
+  # Hermeto 0.52.x x-pnpm does not download tarballs; re-enable hermetic + pnpm prefetch at 0.57.0.
   - name: hermetic
     value: "false"
   - name: prefetch-input
diff --git a/prefetch/pnpm/README.md b/prefetch/pnpm/README.md
index 5db219495..be58c4a1f 100644
--- a/prefetch/pnpm/README.md
+++ b/prefetch/pnpm/README.md
@@ -11,13 +11,25 @@ Since hermetic builds cannot install tools from the network in the Dockerfile, p
 
 Long term, pnpm should be bundled in `registry.access.redhat.com/ubi9/nodejs-22`.
 
+## Hermetic UI dependency prefetch (future)
+
+UI dependencies can be prefetched with Hermeto `pnpm` from `pnpm-lock.yaml` once Konflux ships **Hermeto 0.57.0** .
+
+When 0.57.0 is available, set `hermetic: true` and add to `prefetch-input`:
+
+```json
+[
+  {"type": "npm", "path": "prefetch/pnpm"},
+  {"type": "pnpm", "path": "./sources/argo-cd/ui"}
+]
+```
 ## Regenerate lockfile
 
 ```bash
 npm --prefix prefetch/pnpm install --package-lock-only
 ```
 
-## Tekton prefetch-input
+## Tekton prefetch-input (current)
 
 ```json
 {"type": "npm", "path": "prefetch/pnpm"}
@@ -27,3 +39,4 @@ npm --prefix prefetch/pnpm install --package-lock-only
 
 - Yarn bootstrap: `prefetch/yarn/README.md`
 - Example Dockerfile: `containers/argocd/Dockerfile`
+- Hermeto pnpm docs: https://github.com/hermetoproject/hermeto/blob/main/docs/pnpm.md

From 5923ce7db686fddc60bd93aab83aecc6e4ac39f0 Mon Sep 17 00:00:00 2001
From: nmirasch <neus.miras@gmail.com>
Date: Tue, 7 Jul 2026 10:21:10 +0200
Subject: [PATCH 4/6] Enable hermetic pnpm build

Assisted-by: Cursor
---
 .tekton/argocd-pull-request.yaml |  5 ++---
 .tekton/argocd-push.yaml         |  5 ++---
 containers/argocd/Dockerfile     |  5 +++--
 prefetch/pnpm/README.md          | 23 ++++++++++++-----------
 4 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/.tekton/argocd-pull-request.yaml b/.tekton/argocd-pull-request.yaml
index 3d2d48690..0e4f9c4dd 100644
--- a/.tekton/argocd-pull-request.yaml
+++ b/.tekton/argocd-pull-request.yaml
@@ -60,11 +60,10 @@ spec:
     - linux/x86_64
   - name: dockerfile
     value: containers/argocd/Dockerfile
-  # Hermeto 0.52.x x-pnpm does not download tarballs; re-enable hermetic + pnpm prefetch at 0.57.0.
   - name: hermetic
-    value: "false"
+    value: "true"
   - name: prefetch-input
-    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}, {"type":"npm","path":"prefetch/pnpm"}]'
+    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}, {"type":"npm","path":"prefetch/pnpm"}, {"type":"pnpm","path":"./sources/argo-cd/ui"}]'
   - name: git-metadata-directories
     value:
       - sources/argo-cd
diff --git a/.tekton/argocd-push.yaml b/.tekton/argocd-push.yaml
index 6f828e418..d41de905a 100644
--- a/.tekton/argocd-push.yaml
+++ b/.tekton/argocd-push.yaml
@@ -58,11 +58,10 @@ spec:
       - '{{target_branch}}'
   - name: dockerfile
     value: containers/argocd/Dockerfile
-  # Hermeto 0.52.x x-pnpm does not download tarballs; re-enable hermetic + pnpm prefetch at 0.57.0.
   - name: hermetic
-    value: "false"
+    value: "true"
   - name: prefetch-input
-    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}, {"type":"npm","path":"prefetch/pnpm"}]'
+    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}, {"type":"npm","path":"prefetch/pnpm"}, {"type":"pnpm","path":"./sources/argo-cd/ui"}]'
   - name: git-metadata-directories
     value:
       - sources/argo-cd
diff --git a/containers/argocd/Dockerfile b/containers/argocd/Dockerfile
index ee4a9f1d4..adc5ad983 100644
--- a/containers/argocd/Dockerfile
+++ b/containers/argocd/Dockerfile
@@ -30,9 +30,10 @@ RUN pnpm --version
 
 WORKDIR /usr/src/app/argo-cd/ui
 
-COPY ["sources/argo-cd/ui/package.json", "sources/argo-cd/ui/pnpm-lock.yaml", "./"]
+# Hermeto inject-files (prefetch) patches pnpm-lock.yaml and creates .npmrc in the source tree.
+COPY ["sources/argo-cd/ui/package.json", "sources/argo-cd/ui/pnpm-lock.yaml", "sources/argo-cd/ui/.npmrc", "./"]
 
-RUN pnpm install --frozen-lockfile
+RUN pnpm install --frozen-lockfile --offline
 
 COPY ["sources/argo-cd/ui/", "."]
 
diff --git a/prefetch/pnpm/README.md b/prefetch/pnpm/README.md
index be58c4a1f..46580aa9b 100644
--- a/prefetch/pnpm/README.md
+++ b/prefetch/pnpm/README.md
@@ -9,13 +9,19 @@ Since hermetic builds cannot install tools from the network in the Dockerfile, p
 - Prefetch with Hermeto `npm` during `prefetch-dependencies`
 - Install offline in the Dockerfile via `npm install --prefer-offline`
 
+UI dependencies are prefetched with Hermeto `pnpm` from `pnpm-lock.yaml` (requires **Hermeto 0.57.0+** on Konflux). Konflux routes prefetch through the built-in package registry proxy (`enable-package-registry-proxy: 'true'`); no custom Sonatype setup is required.
+
+During prefetch, Hermeto `inject-files` patches `pnpm-lock.yaml` and creates `.npmrc` under `sources/argo-cd/ui/`. The Dockerfile copies those injected files and runs `pnpm install --offline`.
+
 Long term, pnpm should be bundled in `registry.access.redhat.com/ubi9/nodejs-22`.
 
-## Hermetic UI dependency prefetch (future)
+## Regenerate lockfile
 
-UI dependencies can be prefetched with Hermeto `pnpm` from `pnpm-lock.yaml` once Konflux ships **Hermeto 0.57.0** .
+```bash
+npm --prefix prefetch/pnpm install --package-lock-only
+```
 
-When 0.57.0 is available, set `hermetic: true` and add to `prefetch-input`:
+## Tekton prefetch-input
 
 ```json
 [
@@ -23,17 +29,12 @@ When 0.57.0 is available, set `hermetic: true` and add to `prefetch-input`:
   {"type": "pnpm", "path": "./sources/argo-cd/ui"}
 ]
 ```
-## Regenerate lockfile
 
-```bash
-npm --prefix prefetch/pnpm install --package-lock-only
-```
+Set `hermetic: "true"` on the argocd PipelineRun.
 
-## Tekton prefetch-input (current)
+## Verify Hermeto version in prefetch logs
 
-```json
-{"type": "npm", "path": "prefetch/pnpm"}
-```
+Confirm the `prefetch-dependencies` task logs report **Hermeto 0.57.0** (or newer). On 0.52.x the pnpm backend did not download tarballs and hermetic UI builds failed.
 
 ## References
 

From cc08aee219867d5b9ba3f9cc083d4c754fc9c588 Mon Sep 17 00:00:00 2001
From: nmirasch <neus.miras@gmail.com>
Date: Tue, 7 Jul 2026 15:03:16 +0200
Subject: [PATCH 5/6] Updated .tekton/build-multi-platform-image.yaml to pin
 the new prefetch task bundle

Assisted-by: Cursor
---
 .tekton/build-multi-platform-image.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.tekton/build-multi-platform-image.yaml b/.tekton/build-multi-platform-image.yaml
index a2e13a9d1..c4653f6cc 100644
--- a/.tekton/build-multi-platform-image.yaml
+++ b/.tekton/build-multi-platform-image.yaml
@@ -195,7 +195,7 @@ spec:
       - name: name
         value: prefetch-dependencies-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:3dc78afbf3a441e0280067433cb28ea3d2d0088ec214c73bf063f145b4f273ef
+        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.4@sha256:127cd2d263930d188ed3f6342769188d6f985c1f948aade5ff7e3037247ffd70
       - name: kind
         value: task
       resolver: bundles

From ee5e0869a4bd9673270482d450f01aa68d77a1f8 Mon Sep 17 00:00:00 2001
From: nmirasch <neus.miras@gmail.com>
Date: Wed, 8 Jul 2026 13:11:39 +0200
Subject: [PATCH 6/6] Updated .tekton/build-multi-platform-image.yaml to pin
 the task-prefetch-dependencies-oci-ta:0.4.1

Assisted-by: Cursor
---
 .tekton/build-multi-platform-image.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.tekton/build-multi-platform-image.yaml b/.tekton/build-multi-platform-image.yaml
index c4653f6cc..21f7577a6 100644
--- a/.tekton/build-multi-platform-image.yaml
+++ b/.tekton/build-multi-platform-image.yaml
@@ -195,7 +195,7 @@ spec:
       - name: name
         value: prefetch-dependencies-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.4@sha256:127cd2d263930d188ed3f6342769188d6f985c1f948aade5ff7e3037247ffd70
+        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.4.1@sha256:f1e709bbc226c772eb7f7bfa37c5ba5f8d2f0eca060b3993e771e514f591b093
       - name: kind
         value: task
       resolver: bundles