cmd-build-with-buildah: add --autolock

This matches `cosa build` support for it and is actively used by both
RHCOS and FCOS (rawhide).

Long-term I think this will become obsolete by hermetic builds in
Konflux which will require us to always have in-tree lockfiles.

Author: jlebon

src/cmd-build-with-buildah

@@ -17,14 +17,18 @@ Usage: coreos-assembler build-with-buildah
   --version=VERSION   Use the given version instead of using versionary.
   --versionary        Generate non-development version using versionary.
   --direct            Run buildah directly rather than within supermin.
+  --autolock=VERSION  If no base lockfile used, create one from any arch build of `VERSION`.
+                      Note this is automatically enabled when adding to an existing multi-arch
+                      non-strict build.
 EOF
 }
 
 VERSION=
 VERSIONARY=
 DIRECT=
+AUTOLOCK_VERSION=
 rc=0
-options=$(getopt --options h,d --longoptions help,version:,versionary,direct -- "$@") || rc=$?
+options=$(getopt --options h,d --longoptions help,version:,versionary,direct,autolock: -- "$@") || rc=$?
 [ $rc -eq 0 ] || {
     print_help
     exit 1
@@ -46,6 +50,10 @@ while true; do
         -d | --direct)
             DIRECT=1
             ;;
+        --autolock)
+            shift;
+            AUTOLOCK_VERSION=$1
+            ;;
         --)
             shift
             break
@@ -94,6 +102,18 @@ build_with_buildah() {
         exit 0
     fi
 
+    # Apply autolock from another build for this version (or for another version if
+    # explicitly provided via --autolock) if no base lockfile exists.
+    lockfile="manifest-lock.${arch}.json"
+    if [ ! -f "src/config/${lockfile}" ] && { [ -n "${VERSION}" ] || [ -n "${AUTOLOCK_VERSION}" ]; }; then
+        autolockfile=$(tmprepo=tmp/repo; workdir=.;
+                       generate_autolock "${AUTOLOCK_VERSION:-${VERSION}}")
+        if [ -n "${autolockfile}" ]; then
+            echo "Injecting autolock-generated ${lockfile}..."
+            cp "${autolockfile}" "${tempdir}/src/${lockfile}"
+        fi
+    fi
+
     set -- build --security-opt=label=disable --cap-add=all --device /dev/fuse \
             --build-arg-file "$argsfile" -v "$(realpath "${tempdir}/src")":/run/src \
             --build-arg VERSION="${VERSION}" \