[openshift-4.13] ART-17441: Build ose-machine-os-images hermetically

images/ose-machine-os-images.yml

@@ -8,6 +8,7 @@ content:
       branch:
         target: release-{MAJOR}.{MINOR}
       url: git@github.com:openshift-priv/machine-os-images.git
+      url_pull: git@github.com:adobes1/machine-os-images.git
       web: https://github.com/openshift/machine-os-images
 enabled_repos:
 - rhel-8-baseos-rpms
@@ -26,7 +27,17 @@ konflux:
     # ref thread: https://redhat-internal.slack.com/archives/C04PZ7H0VA8/p1743022042311039
     # can be removed after whilelist is in
     x86_64: linux/amd64
-  network_mode: open
+  cachi2:
+    lockfile:
+      backend: rpm-lockfile-prototype
+    artifact_lockfile:
+      # RHCOS ISO URLs sourced from openshift/installer repo:
+      # data/data/coreos/rhcos.json
+      # These are the same URLs that openshift-install coreos print-stream-json outputs.
+      # Whenever it changes, update these URLs to match .architectures.{arch}.artifacts.metal.formats.iso.disk.location
+      resources:
+      - url: https://rhcos.mirror.openshift.com/art/storage/prod/streams/4.13-9.2/builds/413.92.202402131523-0/x86_64/rhcos-413.92.202402131523-0-live.x86_64.iso
+        filename: coreos-x86_64.iso
 delivery:
   delivery_repo_names:
   - openshift4/ose-machine-os-images-rhel8