Migrate Argo CD Dockerfile to use pnpm

.tekton/argocd-pull-request.yaml

@@ -21,6 +21,7 @@ metadata:
         "containers/argocd/***".pathChanged() ||
         ".tekton/argocd-pull-request.yaml".pathChanged() ||
         "prefetch/rpms/ubi9/***".pathChanged() ||
+        "prefetch/pnpm/***".pathChanged() ||
         ".tekton/build-multi-platform-image.yaml".pathChanged() ||
         ".tekton/tasks/***".pathChanged()
       )
@@ -59,8 +60,10 @@ spec:
     - linux/x86_64
   - name: dockerfile
     value: containers/argocd/Dockerfile
+  - name: hermetic
+    value: "true"
   - name: prefetch-input
-    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"yarn","path":"./sources/argo-cd/ui"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}, {"type":"npm","path":"prefetch/yarn"}]'
+    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}, {"type":"npm","path":"prefetch/pnpm"}, {"type":"pnpm","path":"./sources/argo-cd/ui"}]'
   - name: git-metadata-directories
     value:
       - sources/argo-cd

.tekton/argocd-push.yaml

@@ -20,6 +20,7 @@ metadata:
         "containers/argocd/***".pathChanged() ||
         ".tekton/argocd-push.yaml".pathChanged() ||
         "prefetch/rpms/ubi9/***".pathChanged() ||
+        "prefetch/pnpm/***".pathChanged() ||
         "BUILD".pathChanged() ||
         ".tekton/build-multi-platform-image.yaml".pathChanged() ||
         ".tekton/tasks/***".pathChanged()
@@ -57,8 +58,10 @@ spec:
       - '{{target_branch}}'
   - name: dockerfile
     value: containers/argocd/Dockerfile
+  - name: hermetic
+    value: "true"
   - name: prefetch-input
-    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"yarn","path":"./sources/argo-cd/ui"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}, {"type":"npm","path":"prefetch/yarn"}]'
+    value: '[{"type":"gomod","path":"./sources/argo-cd"}, {"type":"gomod","path":"./sources/kustomize/kustomize"}, {"type":"gomod","path":"./sources/helm"}, {"type":"gomod","path":"./sources/git-lfs"}, {"type":"rpm","path":"prefetch/rpms/ubi9"}, {"type":"npm","path":"prefetch/pnpm"}, {"type":"pnpm","path":"./sources/argo-cd/ui"}]'
   - name: git-metadata-directories
     value:
       - sources/argo-cd

.tekton/build-multi-platform-image.yaml

@@ -195,7 +195,7 @@ spec:
       - name: name
         value: prefetch-dependencies-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:3dc78afbf3a441e0280067433cb28ea3d2d0088ec214c73bf063f145b4f273ef
+        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.4.1@sha256:f1e709bbc226c772eb7f7bfa37c5ba5f8d2f0eca060b3993e771e514f591b093
       - name: kind
         value: task
       resolver: bundles

config.yaml

@@ -29,8 +29,8 @@ sources:
     commit: fee011bc839911e119c8d774e97308222b4dfa8f
   - path: sources/argo-cd 
     url: https://github.com/argoproj/argo-cd.git
-    ref: v3.4.2
-    commit: 0dc6b1b57dd5bb925d5b03c3d09419ab9fb4225e
+    ref: master
+    commit: f5f3bf8a064956efd13eb02cc6702319ab564ed6
   - path: sources/argo-rollouts 
     url: https://github.com/argoproj/argo-rollouts.git
     ref: v1.8.3

containers/argocd/Dockerfile

@@ -21,25 +21,26 @@ FROM registry.access.redhat.com/ubi9/nodejs-22 AS argocd-ui
 
 USER root
 
-# Install Yarn
+# Install pnpm via npm prefetch bootstrap (same pattern as prefetch/yarn)
 WORKDIR /usr/src/app
-COPY ["prefetch/yarn/package.json", "prefetch/yarn/package-lock.json", "./"]
+COPY ["prefetch/pnpm/package.json", "prefetch/pnpm/package-lock.json", "./"]
 RUN npm install --prefer-offline --no-progress --non-interactive
-ENV YARN="/usr/src/app/node_modules/.bin/yarn"
-RUN $YARN --version
+ENV PATH="/usr/src/app/node_modules/.bin:${PATH}"
+RUN pnpm --version
 
 WORKDIR /usr/src/app/argo-cd/ui
 
-COPY ["sources/argo-cd/ui/package.json", "sources/argo-cd/ui/yarn.lock", "./"]
+# Hermeto inject-files (prefetch) patches pnpm-lock.yaml and creates .npmrc in the source tree.
+COPY ["sources/argo-cd/ui/package.json", "sources/argo-cd/ui/pnpm-lock.yaml", "sources/argo-cd/ui/.npmrc", "./"]
 
-RUN $YARN  install --no-progress --non-interactive --prefer-offline --network-timeout 200000 && \
-    $YARN cache clean
+RUN pnpm install --frozen-lockfile --offline
 
 COPY ["sources/argo-cd/ui/", "."]
 
 ARG ARGO_VERSION=latest
 ENV ARGO_VERSION=$ARGO_VERSION
-RUN NODE_ONLINE_ENV='offline' NODE_ENV='production' $YARN build
+ARG TARGETARCH
+RUN HOST_ARCH=${TARGETARCH:-amd64} NODE_ENV='production' NODE_ONLINE_ENV='offline' NODE_OPTIONS=--max_old_space_size=8192 pnpm build
 
 ####################################################################################################
 # Argo CD Build stage which performs the actual build of Argo CD binaries

prefetch/pnpm/README.md

@@ -0,0 +1,43 @@
+# pnpm Bootstrap via npm Prefetch
+
+Related: [GITOPS-9932](https://redhat.atlassian.net/browse/GITOPS-9932)
+
+The **Node.js base images used in Konflux do not include pnpm**.  
+Since hermetic builds cannot install tools from the network in the Dockerfile, pnpm is bootstrapped the same way as Yarn v1 in `prefetch/yarn/`:
+
+- Pin `pnpm` in `package.json` / `package-lock.json`
+- Prefetch with Hermeto `npm` during `prefetch-dependencies`
+- Install offline in the Dockerfile via `npm install --prefer-offline`
+
+UI dependencies are prefetched with Hermeto `pnpm` from `pnpm-lock.yaml` (requires **Hermeto 0.57.0+** on Konflux). Konflux routes prefetch through the built-in package registry proxy (`enable-package-registry-proxy: 'true'`); no custom Sonatype setup is required.
+
+During prefetch, Hermeto `inject-files` patches `pnpm-lock.yaml` and creates `.npmrc` under `sources/argo-cd/ui/`. The Dockerfile copies those injected files and runs `pnpm install --offline`.
+
+Long term, pnpm should be bundled in `registry.access.redhat.com/ubi9/nodejs-22`.
+
+## Regenerate lockfile
+
+```bash
+npm --prefix prefetch/pnpm install --package-lock-only
+```
+
+## Tekton prefetch-input
+
+```json
+[
+  {"type": "npm", "path": "prefetch/pnpm"},
+  {"type": "pnpm", "path": "./sources/argo-cd/ui"}
+]
+```
+
+Set `hermetic: "true"` on the argocd PipelineRun.
+
+## Verify Hermeto version in prefetch logs
+
+Confirm the `prefetch-dependencies` task logs report **Hermeto 0.57.0** (or newer). On 0.52.x the pnpm backend did not download tarballs and hermetic UI builds failed.
+
+## References
+
+- Yarn bootstrap: `prefetch/yarn/README.md`
+- Example Dockerfile: `containers/argocd/Dockerfile`
+- Hermeto pnpm docs: https://github.com/hermetoproject/hermeto/blob/main/docs/pnpm.md

prefetch/pnpm/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "pnpm-install",
+  "version": "10.28.1",
+  "dependencies": {
+    "pnpm": "10.28.1"
+  }
+}