Refactor image build, create multi-arch images, drop Builder usage

.github/workflows/build-base-image.yml

@@ -0,0 +1,173 @@
+name: Reusable workflow for single multi-arch image build
+
+on:
+  workflow_call:
+    inputs:
+      architectures:
+        description: Architectures to build (JSON array, e.g., '["amd64", "aarch64"]')
+        required: true
+        type: string
+      build-args:
+        description: Additional build arguments (key=value format, one per line)
+        required: false
+        default: ""
+        type: string
+      cache-gha:
+        description: Whether to use GitHub Actions cache for build caching
+        required: false
+        default: true
+        type: boolean
+      cache-gha-scope:
+        description: Scope for build cache sharing (defaults to architecture, set if building multiple images from a single repo)
+        required: false
+        default: ""
+        type: string
+      cache-image-tag:
+        description: Tag of the image containing BuildKit inline cache metadata
+        required: false
+        default: "latest"
+        type: string
+      context:
+        description: Build context path (usually the directory with Dockerfile)
+        required: true
+        type: string
+      cosign:
+        description: Whether to sign images with Cosign
+        required: false
+        default: true
+        type: boolean
+      cosign-base-identity:
+        description: Certificate identity regexp for verifying the base (FROM) image
+        required: false
+        default: ""
+        type: string
+      cosign-base-issuer:
+        description: Certificate OIDC issuer regexp for base image verification (defaults to cosign-issuer)
+        required: false
+        default: ""
+        type: string
+      cosign-base-verify:
+        description: Base image reference to verify with cosign before building
+        required: false
+        default: ""
+        type: string
+      cosign-identity:
+        description: Certificate identity regexp for verifying cache images (defaults to current repo pattern)
+        required: false
+        default: ""
+        type: string
+      cosign-issuer:
+        description: Certificate OIDC issuer regexp for all cosign verification
+        required: false
+        default: "https://token.actions.githubusercontent.com"
+        type: string
+      file:
+        description: Dockerfile path (defaults to "Dockerfile" in the context directory)
+        required: false
+        default: ""
+        type: string
+      image-name:
+        description: Image name without a tag (e.g., "base-python")
+        required: true
+        type: string
+      image-tags:
+        description: Image tags, one per line
+        required: true
+        type: string
+      labels:
+        description: Additional OCI labels (key=value format, one per line)
+        required: false
+        default: ""
+        type: string
+      multi-arch:
+        description: Prefix per-arch image names with architecture (required for multiple architectures)
+        required: false
+        default: true
+        type: boolean
+      push:
+        description: Whether to push images to registry
+        required: false
+        default: false
+        type: boolean
+      version:
+        description: Image version label
+        required: true
+        type: string
+
+jobs:
+  prepare:
+    name: Prepare build matrix
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.prepare.outputs.matrix }}
+    steps:
+      - name: Prepare multi-arch matrix
+        id: prepare
+        uses: home-assistant/builder/actions/prepare-multi-arch-matrix@gha-builder
+        with:
+          architectures: ${{ inputs.architectures }}
+          image-name: ${{ inputs.image-name }}
+          multi-arch: ${{ inputs.multi-arch }}
+
+  build:
+    name: Build ${{ matrix.arch }} image
+    needs: prepare
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.prepare.outputs.matrix) }}
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Build image
+        id: build
+        uses: home-assistant/builder/actions/build-image@gha-builder
+        with:
+          arch: ${{ matrix.arch }}
+          build-args: ${{ inputs.build-args }}
+          cache-gha: ${{ inputs.cache-gha }}
+          cache-gha-scope: ${{ inputs.cache-gha-scope }}
+          cache-image-tag: ${{ inputs.cache-image-tag }}
+          container-registry-password: ${{ secrets.GITHUB_TOKEN }}
+          context: ${{ inputs.context }}
+          cosign: ${{ inputs.cosign }}
+          cosign-base-identity: ${{ inputs.cosign-base-identity }}
+          cosign-base-issuer: ${{ inputs.cosign-base-issuer }}
+          cosign-base-verify: ${{ inputs.cosign-base-verify }}
+          cosign-identity: ${{ inputs.cosign-identity }}
+          cosign-issuer: ${{ inputs.cosign-issuer }}
+          file: ${{ inputs.file }}
+          image: ${{ matrix.image }}
+          image-tags: ${{ inputs.image-tags }}
+          labels: |
+            io.hass.base.arch=${{ matrix.arch }}
+            io.hass.base.version=${{ inputs.version }}
+            ${{ inputs.labels }}
+          push: ${{ inputs.push }}
+          version: ${{ inputs.version }}
+
+  manifest:
+    name: Publish multi-arch manifest
+    if: inputs.push && inputs.multi-arch
+    needs: [prepare, build]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    steps:
+      - name: Publish multi-arch manifest
+        uses: home-assistant/builder/actions/publish-multi-arch-manifest@gha-builder
+        with:
+          architectures: ${{ inputs.architectures }}
+          container-registry-password: ${{ secrets.GITHUB_TOKEN }}
+          cosign: ${{ inputs.cosign }}
+          image-name: ${{ inputs.image-name }}
+          image-tags: ${{ inputs.image-tags }}