Sign & Shadow ghcr upload (#172)

.github/workflows/builder.yml

@@ -73,16 +73,26 @@ jobs:
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+    - name: Login to GitHub Container Registry
+      if: github.event_name == 'release'
+      uses: docker/login-action@v1
+      with:
+        registry: ghcr.io
+        username: ${{ secrets.GIT_USER }}
+        password: ${{ secrets.GIT_TOKEN }}
 
     - name: Set build arguments
       if: github.event_name != 'release'
       run: echo "BUILD_ARGS=--test" >> $GITHUB_ENV
 
     - name: Build base image
-      uses: home-assistant/builder@2021.02.0
+      uses: home-assistant/builder@2021.03.3
       with:
         args: |
           $BUILD_ARGS \
           --${{ matrix.arch }} \
           --target /data \
+          --with-codenotary "${{ secrets.VCN_USER }}" "${{ secrets.VCN_PASSWORD }}" "${{ secrets.VCN_ORG }}" \
+          --validate-from "${{ secrets.VCN_ORG }}" \
           --generic ${{ needs.init.outputs.version }}

build.json

@@ -1,11 +1,12 @@
 {
   "image": "homeassistant/{arch}-homeassistant-base",
+  "shadow_repository": "ghcr.io/home-assistant",
   "build_from": {
-    "aarch64": "homeassistant/aarch64-base-python:3.8-alpine3.12",
-    "armhf": "homeassistant/armhf-base-python:3.8-alpine3.12",
-    "armv7": "homeassistant/armv7-base-python:3.8-alpine3.12",
-    "amd64": "homeassistant/amd64-base-python:3.8-alpine3.12",
-    "i386": "homeassistant/i386-base-python:3.8-alpine3.12"
+    "aarch64": "ghcr.io/home-assistant/aarch64-base-python:3.8-alpine3.12",
+    "armhf": "ghcr.io/home-assistant/armhf-base-python:3.8-alpine3.12",
+    "armv7": "ghcr.io/home-assistant/armv7-base-python:3.8-alpine3.12",
+    "amd64": "ghcr.io/home-assistant/amd64-base-python:3.8-alpine3.12",
+    "i386": "ghcr.io/home-assistant/i386-base-python:3.8-alpine3.12"
   },
   "labels": {
     "io.hass.type": "homeassistant-base"