fix(contract build): Add --locked argument to ensure deterministic builds

cmd/crates/soroban-test/tests/it/build.rs

@@ -69,6 +69,24 @@ fn build_package_by_current_dir() {
         ));
 }
 
+#[test]
+fn build_with_locked() {
+    let sandbox = TestEnv::default();
+    let cargo_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let fixture_path = cargo_dir.join("tests/fixtures/workspace/contracts/add");
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(fixture_path)
+        .arg("build")
+        .arg("--print-commands-only")
+        .arg("--locked")
+        .assert()
+        .success()
+        .stdout(predicate::eq(
+            with_flags("cargo rustc --locked --manifest-path=Cargo.toml --crate-type=cdylib --target=wasm32v1-none --release"),
+        ));
+}
+
 #[test]
 fn build_no_package_found() {
     let sandbox = TestEnv::default();

cmd/soroban-cli/src/commands/contract/build.rs

@@ -88,6 +88,10 @@ pub struct Cmd {
     #[arg(long)]
     pub out_dir: Option<std::path::PathBuf>,
 
+    /// Assert that `Cargo.lock` will remain unchanged
+    #[arg(long)]
+    pub locked: bool,
+
     /// Print commands to build without executing them
     #[arg(long, conflicts_with = "out_dir", help_heading = "Other")]
     pub print_commands_only: bool,
@@ -197,6 +201,7 @@ impl Default for Cmd {
             all_features: false,
             no_default_features: false,
             out_dir: None,
+            locked: false,
             print_commands_only: false,
             build_args: BuildArgs::default(),
         }
@@ -233,6 +238,9 @@ impl Cmd {
             let mut cmd = Command::new("cargo");
             cmd.stdout(Stdio::piped());
             cmd.arg("rustc");
+            if self.locked {
+                cmd.arg("--locked");
+            }
             let manifest_path = pathdiff::diff_paths(&p.manifest_path, &working_dir)
                 .unwrap_or(p.manifest_path.clone().into());
             cmd.arg(format!(