TESTING: Migrate Argo CD Dockerfile to use pnpm

[nmirasch]

Assisted-by: Cursor

[svghadi]

Is it possible to install pnpm in this manner? Ideally we should request the registry.access.redhat.com/ubi9/nodejs-22 maintainers to have pnpm bundled in the image but that will take time.

[svghadi]

Looks good overall. The conforma failure is expected and we can get it fixed later via policy exception. We should now look into using Nexus registry as proxy. Please ping me on slack, I will share the registry details

[nmirasch]

Bootstrapping the pnpm CLI using the same npm prefetch pattern as prefetch/yarn:

Current Konflux pipeline run validations

• pnpm CLI via npm prefetch works in Konflux
• prefetch-dependencies succeeded with {"type":"npm","path":"prefetch/pnpm"} - pnpm 10.28.1 prefetched via the cluster npm proxy
• Dockerfile bootstrap worked: npm install --prefer-offline → pnpm --version → 10.28.1
• pnpm install --frozen-lockfile →succeeded UI dependencies still require network because they are not prefetched yet
• pnpm build / webpack completed successfully
• Image built and pushed to Quay

Current limitations / next steps

• hermetic: false - Hermeto does not support pnpm-lock.yaml prefetch yet (Support for pnpm package manager hermetoproject/hermeto#1251)
• UI deps (~1,198 packages) are fetched during the image build, not in prefetch-dependencies
• For full hermetic UI builds
  • Prefetch UI deps via generic-fetcher or future native Hermeto pnpm support (hermetic: true, pnpm install --offline)
  • Bundling pnpm in ubi9/nodejs-22 would only remove the CLI bootstrap step
• Nexus / registry proxy
  • CLI prefetch already used the cluster npm proxy; next step is to configure/validate Nexus for UI pnpm install traffic (~1,198 packages/build)
• Post-build checks (preflight HasLicense, shellcheck, Coverity license) failed but appear unrelated to the pnpm migration. Conforma/policy exceptions may still be needed