ci: update home-assistant/builder action to v2026 - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
home-assistant/builder	action	major	2021.11.3 → 2026.03.2

---

Release Notes

home-assistant/builder (home-assistant/builder)

v2026.03.2

Compare Source

[!WARNING]
Since 2026.03.0, the home-assistant/builder action is deprecated in favor of more efficient and flexible composable actions. See the builder repository for details.

What's Changed

• Correctly ignore home-assistant/builder update in action.yml and .github (#​288) @​sairon
• Bump docker/setup-buildx-action from 3.12.0 to 4.0.0 in /actions/publish-multi-arch-manifest (#​287) @​dependabot[bot]
• Bump docker/setup-buildx-action from 3.12.0 to 4.0.0 in /actions/build-image (#​286) @​dependabot[bot]
• Bump docker/build-push-action from 6.19.2 to 7.0.0 in /actions/build-image (#​283) @​dependabot[bot]
• Bump home-assistant/builder from 2026.03.0 to 2026.03.1 in /actions/build-image (#​284) @​dependabot[bot]
• Update dependabot configuration (#​282) @​sairon

v2026.03.1

Compare Source

[!WARNING]
Since 2026.03.0, the home-assistant/builder action is deprecated in favor of more efficient and flexible composable actions. See the builder repository for details.

What's Changed

• Correctly pin cosign-verify action in build-image action (#​281) @​sairon

v2026.03.0

Compare Source

[!WARNING]
This release deprecates the home-assistant/builder action in favor of more efficient and flexible composable actions. See the builder repository for details.

What's Changed

• Add reusable actions for native BuildKit build in GHA (#​273) @​sairon
• Deprecate usage of home-assistant/builder, update README (#​279) @​sairon
• Bump sigstore/cosign-installer from 4.0.0 to 4.1.0 (#​276) @​dependabot[bot]
• Bump release-drafter/release-drafter from 6.4.0 to 7.0.0 (#​278) @​dependabot[bot]
• Bump release-drafter/release-drafter from 6.2.0 to 6.4.0 (#​275) @​dependabot[bot]
• Bump docker/login-action from 3.7.0 to 4.0.0 (#​274) @​dependabot[bot]
• Bump home-assistant/builder from 2026.02.0 to 2026.02.1 (#​272) @​dependabot[bot]

v2026.02.1

Compare Source

What's Changed

• Use official hadolint/hadolint-action instead of fork (#​271) @​sairon
• SHA-pin all pinnable actions, use builder 2026.02.0 (#​270) @​sairon

v2026.02.0

Compare Source

What's Changed

• Tag published builder images with commit SHA (#​269) @​sairon
• Revert "Disable ASLR to work around QEMU aarch64 issues (#​229)" (#​267) @​sairon
• Bump docker/login-action from 3.6.0 to 3.7.0 (#​268) @​dependabot[bot]
• Bump home-assistant/builder from 2025.09.0 to 2025.11.0 (#​266) @​dependabot[bot]

v2025.11.0

Compare Source

💥 Breaking Changes

This release removes support for the armv7, i386, and armhf architectures which were previously announced as deprecated in the Home Assistant architecture decisions (https://redirect.github.com/home-assistant/architecture/discussions/1230, https://redirect.github.com/home-assistant/architecture/discussions/1200, https://redirect.github.com/home-assistant/architecture/discussions/1199).

The --all flag has has been removed since it could silently fail for add-on developers who relied on it in builds for the deprecated architectures using the latest version of the builder action. If your build process uses --all, update it to specify architectures explicitly (e.g., --amd64 --aarch64) or use a matrix strategy for the build job (see addons-example for a concrete example of an add-on build workflow).

If you need to build images for the deprecated architectures, you can specify an older builder action, e.g. home-assistant/builder@2025.09.0 which still supports build of these architectures, including the --all flag.

What's Changed

• Drop support for --all in favor of explicit architecture arguments (#​265) @​sairon
• Don't refer to @master action in the readme examples (#​264) @​sairon
• actions/publish: use dotslash self-reference (#​258) @​eshattow
• Remove deprecated archs (#​263) @​edenhaus
• Bump actions/checkout from 5 to 6 (#​262) @​dependabot[bot]
• Bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#​254) @​dependabot[bot]
• Bump docker/login-action from 3.5.0 to 3.6.0 (#​253) @​dependabot[bot]
• Bump home-assistant/builder from 2025.03.0 to 2025.09.0 (#​252) @​dependabot[bot]

v2025.09.0

Compare Source

What's Changed

• Add --no-cosign-verify flag to disable Cosign signature verification (#​251) @​sairon
• Update to cosign v2.5.3 (#​250) @​agners
• Bump sigstore/cosign-installer from 3.9.2 to 3.10.0 (#​249) @​dependabot[bot]
• Update to Alpine Linux 3.22 (#​248) @​eshattow
• Bump actions/checkout from 4 to 5 (#​247) @​dependabot[bot]
• Bump docker/login-action from 3.4.0 to 3.5.0 (#​246) @​dependabot[bot]
• Bump sigstore/cosign-installer from 3.9.1 to 3.9.2 (#​244) @​dependabot[bot]
• Bump sigstore/cosign-installer from 3.9.0 to 3.9.1 (#​243) @​dependabot[bot]
• Bump sigstore/cosign-installer from 3.8.2 to 3.9.0 (#​242) @​dependabot[bot]
• Bump sigstore/cosign-installer from 3.8.1 to 3.8.2 (#​241) @​dependabot[bot]
• Bump home-assistant/builder from 2025.02.0 to 2025.03.0 (#​240) @​dependabot[bot]

v2025.03.0

Compare Source

What's Changed

• Migrate to tonistiigi/binfmt (#​239) @​frenck
• Bump docker/login-action from 3.3.0 to 3.4.0 (#​238) @​dependabot[bot]
• Bump home-assistant/builder from 2024.08.2 to 2025.02.0 (#​235) @​dependabot[bot]

v2025.02.0

Compare Source

What's Changed

• Use ghcr.io as default registry for base image/instructions (#​233) @​agners
• Update to cosign v2.4.3 (#​232) @​agners
• Make builder image arch selectible (#​231) @​mib1185
• Disable ASLR to work around QEMU aarch64 issues (#​229) @​agners
• Bump sigstore/cosign-installer from 3.8.0 to 3.8.1 (#​230) @​dependabot[bot]
• Bump sigstore/cosign-installer from 3.7.0 to 3.8.0 (#​228) @​dependabot[bot]
• Bump olegtarasov/get-tag from 2.1.3 to 2.1.4 (#​227) @​dependabot[bot]
• Bump sigstore/cosign-installer from 3.6.0 to 3.7.0 (#​224) @​dependabot[bot]
• Bump home-assistant/builder from 2024.08.1 to 2024.08.2 (#​221) @​dependabot[bot]

v2024.08.2

Compare Source

What's Changed

• Update to cosign v2.4.0 (#​220) @​agners
• bug fix issue 209 default Alpine version 3.13->3.20 (#​210) @​skyshino
• Bump home-assistant/builder from 2024.03.5 to 2024.08.1 (#​219) @​dependabot

v2024.08.1

Compare Source

What's Changed

• Make sure builder image is pulled by default (#​218) @​agners

v2024.08.0

Compare Source

What's Changed

• Use manifest digest for signing (#​217) @​agners
• Trust git repositories in builder (#​216) @​agners
• Bump to Alpine 3.20 (#​215) @​agners
• Use released versions of the builder (#​214) @​agners
• Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 (#​211) @​dependabot
• Bump docker/login-action from 3.2.0 to 3.3.0 (#​208) @​dependabot
• Inform if build information are not available (#​143) @​agners
• Bump docker/login-action from 3.1.0 to 3.2.0 (#​205) @​dependabot
• Apply labels from add-on build.(yaml|json) when building add-on (#​203) @​lildude
• Bump sigstore/cosign-installer from 3.4.0 to 3.5.0 (#​204) @​dependabot
• Update get-tag GitHub Action to v2.1.3 (#​202) @​agners

v2024.03.5

Compare Source

What's Changed

• Reenable cosign verification (#​201) @​agners

v2024.03.4

Compare Source

What's Changed

• Reenable cosign signing (#​200) @​agners

v2024.03.3

Compare Source

What's Changed

• Disable cosign verification by default (#​199) @​agners

v2024.03.2

Compare Source

What's Changed

• Disable cosign signing by @​agners in #​198

Full Changelog: home-assistant/builder@2024.03.1...2024.03.2

v2024.03.1

Compare Source

What's Changed

• Disable cosign signature verification by @​agners in #​197

Full Changelog: home-assistant/builder@2024.03.0...2024.03.1

v2024.03.0

Compare Source

What's Changed

• Use default cosign version v2.2.3 provided by cosign-installer action (#​196) @​agners
• Bump docker/login-action from 3.0.0 to 3.1.0 (#​194) @​dependabot
• Bump release-drafter/release-drafter from 5 to 6 (#​192) @​dependabot
• Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 (#​191) @​dependabot

v2024.01.0

Compare Source

What's Changed

• Fix i386 builds reporting x86_64 in the build process (#​189) @​bdraco
• Bump sigstore/cosign-installer from 3.2.0 to 3.3.0 (#​188) @​dependabot

v2023.12.0

Compare Source

What's Changed

• Add Raspberry Pi 5 board (#​187) @​agners
• Bump sigstore/cosign-installer from 3.1.2 to 3.2.0 (#​186) @​dependabot
• Document new builder location on ghcr.io (#​185) @​agners

v2023.09.0

Compare Source

What's Changed

• Ditch CAS env (#​183) @​pvizeli
• Remove Codenotary CAS (#​182) @​pvizeli
• Bump docker/login-action from 2.2.0 to 3.0.0 (#​181) @​dependabot
• Bump sigstore/cosign-installer from 3.1.1 to 3.1.2 (#​179) @​dependabot
• Bump actions/checkout from 3 to 4 (#​180) @​dependabot

v2023.08.0

Compare Source

What's Changed

• Fix get branch (last part from path) to correct behavior in case of different path lengths (#​174) @​adeepn
• Add Home Assistant Green (#​176) @​agners
• Bump sigstore/cosign-installer from 3.1.0 to 3.1.1 (#​175) @​dependabot
• Bump sigstore/cosign-installer from 3.0.5 to 3.1.0 (#​173) @​dependabot

v2023.06.1

Compare Source

What's Changed

• Validate with cosign / ditch codenotary-v1 (#​171) @​pvizeli

v2023.06.0

Compare Source

What's Changed

• Verify image on action (#​169) @​pvizeli
• Only support github registry (#​168) @​pvizeli
• Enable cosign on build / ditch cas from action (#​167) @​pvizeli
• Sign images with cosign (#​166) @​pvizeli
• Bump docker/login-action from 2.1.0 to 2.2.0 (#​165) @​dependabot

v2023.03.0

Compare Source

What's Changed

• Add support for odroid-m1 (#​163) @​agners
• Remove deprecated set-output command (#​161) @​agners

v2022.11.0

Compare Source

What's Changed

• Add support for arch specifc dockerfiles (#​160) @​pvizeli
• Bump docker/login-action from 2.0.0 to 2.1.0 (#​157) @​dependabot

v2022.09.0

Compare Source

What's Changed

• Better host support (#​155) @​asosnovsky

v2022.07.0

Compare Source

What's Changed

• Use buildx when building images (#​150) @​ludeeus
• Update actions (#​152) @​wrt54g
• Bump base image to 3.16 (#​151) @​ludeeus

v2022.06.2

Compare Source

What's Changed

• Add yellow support (#​149) @​pvizeli
• Do not validate scratch (#​148) @​ludeeus

v2022.06.1

Compare Source

What's Changed

• Fix docker build env (#​146) @​pvizeli

v2022.06.0

Compare Source

What's Changed

• Adjust Qemu CPU for armhf / v6 (#​145) @​pvizeli
• Don't fail using cache if an image only exists locally (#​142) @​agners
• Bump docker/login-action from 1.14.1 to 2.0.0 (#​141) @​dependabot

v2022.03.1

Compare Source

What's Changed

• Bump actions/checkout from 2.4.0 to 3 (#​138) @​dependabot
• Bump docker/login-action from 1.14.0 to 1.14.1 (#​137) @​dependabot
• Include platform in CI output (#​139) @​mdegat01

v2022.03.0

Compare Source

What's Changed

• Provide platform arg with image pulls (#​135) @​mdegat01
• Remove shellcheck package from devcontainer (#​136) @​mdegat01
• Bump docker/login-action from 1.13.0 to 1.14.0 (#​134) @​dependabot
• Bump docker/login-action from 1.12.0 to 1.13.0 (#​132) @​dependabot

v2022.01.0

Compare Source

What's Changed

• fetch repository before copying build_config (#​128) @​MoronixProduct3
• Bump docker/login-action from 1.10.0 to 1.12.0 (#​126) @​dependabot

v2021.12.0

Compare Source

What's Changed

• Add additional-tag argument (#​125) @​ludeeus

v2021.11.4

Compare Source

What's Changed

• Clean version_tag function (#​123) @​pvizeli
• Fix machine extraction broken by #​114 (#​122) @​pvizeli

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.