ci: lock all kas repos

This guarantees that the build job can be easily replicated later.
The kas will generate a file named base.lock.yml which will later be used instead of base.yml,
we will save the lock file in the persistent storage.

Reference:
https://kas.readthedocs.io/en/latest/userguide/project-configuration.html#working-with-lockfiles

Signed-off-by: Jose Quaresma <[email protected]>

.github/workflows/build-yocto.yml

@@ -7,18 +7,50 @@ on:
       - main
 
 jobs:
+  kas-lock:
+    runs-on: [self-hosted, x86]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run kas lock
+        run: |
+          kas dump --update --lock --inplace ci/base.yml
+
+      - name: Prepare artifact
+        run: |
+          mkdir ci/lock
+          mv -v ci/*.lock.yml ci/lock
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: kas-lock
+          path: ci/lock
+
   yocto-check-layer:
+    needs: kas-lock
     runs-on: [self-hosted, x86]
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
+      - uses: actions/download-artifact@v4
+        with:
+          name: kas-lock
+          path: ci/lock
+
+      - name: Prepare artifact
+        run: |
+          mv -v ci/lock/* ci
+
       - name: Run yocto-check-layer
         run: |
           ci/yocto-check-layer.sh
 
   compile:
+    needs: kas-lock
     strategy:
       fail-fast: true
       matrix:
@@ -33,6 +65,15 @@ jobs:
         with:
           fetch-depth: 0
 
+      - uses: actions/download-artifact@v4
+        with:
+          name: kas-lock
+          path: ci/lock
+
+      - name: Prepare artifact
+        run: |
+          mv -v ci/lock/* ci
+
       - name: Kas build
         run: |
           export DL_DIR=/srv/gh-runners/quic-yocto/downloads