build: replace Dapper with single-Dockerfile build system

.dockerignore

@@ -1,2 +1,11 @@
+# git dir is excluded to avoid passing the entire git object database through
+# the build context; stages that need git use git-init inside the stage.
+.git
+
 ./.dapper
-./.cache
+/.cache
+*.swp
+.idea/
+
+# /bin is intentionally NOT excluded because `make package-*` targets use the
+# project root as docker build context and the package Dockerfiles do COPY bin/...

.gitignore

@@ -2,4 +2,5 @@
 /.cache
 /bin
 *.swp
-.idea
+.idea/
+scripts/.version_env

Dockerfile

@@ -0,0 +1,68 @@
+FROM golang:1.25.7-bookworm AS builder
+ARG MK_HOST_ARCH
+ENV ARCH=$MK_HOST_ARCH
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    gzip \
+    tar \
+    gawk \
+    docker.io \
+    wget \
+    make \
+    binutils \
+    gcc \
+    linux-libc-dev \
+    linux-libc-dev-arm64-cross \
+    libc6-dev-arm64-cross \
+    gcc-11-aarch64-linux-gnu \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=golangci/golangci-lint:v2.11.4-alpine@sha256:72bcd68512b4e27540dd3a778a1b7afd45759d8145cfb3c089f1d7af53e718e9 /usr/bin/golangci-lint /usr/local/bin/golangci-lint
+
+ENV HOME=/go/src/github.com/harvester/csi-driver-lvm
+
+# ---- base ----
+FROM builder AS base
+WORKDIR /go/src/github.com/harvester/csi-driver-lvm
+COPY . .
+
+# ---- build ----
+FROM base AS build
+ARG MK_REPO_ID
+
+RUN --mount=type=cache,target=/go/pkg/mod,id=csi-driver-lvm-go-mod-${MK_REPO_ID} \
+    --mount=type=cache,target=/go/src/github.com/harvester/csi-driver-lvm/.cache/go-build,id=csi-driver-lvm-go-build-${MK_REPO_ID} \
+    ./scripts/build
+
+FROM scratch AS build-output
+COPY --from=build /go/src/github.com/harvester/csi-driver-lvm/bin/ /bin/
+
+# ---- validate ----
+FROM base AS validate
+ARG MK_REPO_ID
+
+RUN --mount=type=cache,target=/go/pkg/mod,id=csi-driver-lvm-go-mod-${MK_REPO_ID} \
+    --mount=type=cache,target=/go/src/github.com/harvester/csi-driver-lvm/.cache/go-build,id=csi-driver-lvm-go-build-${MK_REPO_ID} \
+    ./scripts/validate
+
+# ---- validate-ci ----
+FROM base AS validate-ci
+ARG MK_REPO_ID
+
+RUN git config --global user.email "ci@example.com" && \
+    git config --global user.name "ci" && \
+    git init 2>/dev/null && git add . && git commit -q -m "commit for validate-ci"
+
+RUN --mount=type=cache,target=/go/pkg/mod,id=csi-driver-lvm-go-mod-${MK_REPO_ID} \
+    --mount=type=cache,target=/go/src/github.com/harvester/csi-driver-lvm/.cache/go-build,id=csi-driver-lvm-go-build-${MK_REPO_ID} \
+    ./scripts/validate-ci
+
+# ---- test ----
+FROM base AS test
+ARG MK_REPO_ID
+
+RUN --mount=type=cache,target=/go/pkg/mod,id=csi-driver-lvm-go-mod-${MK_REPO_ID} \
+    --mount=type=cache,target=/go/src/github.com/harvester/csi-driver-lvm/.cache/go-build,id=csi-driver-lvm-go-build-${MK_REPO_ID} \
+    ./scripts/test

Makefile

@@ -1,26 +1,93 @@
-TARGETS := $(shell ls scripts)
-
-SHA512SUM_Linux_aarch64 := 781951b31e5ff018a04e755c6da7163b31a81edda61f1bed4def8d0e24229865c58a3d26aa0cc4184058d91ebcae300ead2cad16d3c46ccb1098419e3e41a016
-SHA512SUM_Linux_x86_64 := d2ec27ecf9362e2fafd27d76d85a5c5b92b53aefe07cffa76bf9887db6bee07b1023cca8fc32a2c9bdd2ecfadaee71397066b41bd37c9ebbbbce09913f0884d4
-SHA512SUM_Darwin_arm64 := 8a356c89ad32af1698ae8615a6e303773a8ac58b114368454d59965ec2aa8282e780d1e228d37c301ce6f87596f68bfe7f204eb5f4c019c386a58dd94153ddcf
-SHA512SUM_Darwin_x86_64 := dbab05de04dda26793f4ae7875d0fba96ee54b0228e192fd40c0b2116ed345b5444047fc2e0c90cb481f28cbe0e0452bcecb268c8d074cd8615eb2f5463c30b6
-SHA512SUM_Windows_x86_64 := 807aee2f68b6da35cb0885558f5cbc9a6c8747a56c7a200f0e1fcac9e2fd0da570cbb39e48b3192bd1a71805f2ab38fd19d77faebba97a89e5d9a8b430ee429e
-
-.dapper:
-	@echo Downloading dapper
-	@curl -sL https://releases.rancher.com/dapper/v0.6.0/dapper-`uname -s`-`uname -m` > .dapper.tmp
-	@CHECKSUM=$$(shasum -a 512 .dapper.tmp | awk '{print $$1}'); \
-	if [ "$$CHECKSUM" != "$(SHA512SUM_$(shell uname -s)_$(shell uname -m))" ]; then \
-		echo "Checksum verification failed!"; \
-		exit 1; \
-	fi
-	@@chmod +x .dapper.tmp
-	@./.dapper.tmp -v
-	@mv .dapper.tmp .dapper
-
-$(TARGETS): .dapper
-	./.dapper $@
+ROOT := $(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
+
+DOCKER_BUILDKIT := 1
+export DOCKER_BUILDKIT
+
+MK_HOST_ARCH ?= $(shell uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
+export MK_HOST_ARCH
+
+MK_REPO_ID := $(shell echo -n "$(ROOT)$$(cat /etc/machine-id 2>/dev/null)" | sha256sum | cut -c1-8)
+export MK_REPO_ID
+
+MK_DOCKER_PROGRESS ?= plain
+export MK_DOCKER_PROGRESS
+
+MK_DOCKER_PULL ?= --pull
+export MK_DOCKER_PULL
+
+ifdef CI
+  BOLD  :=
+  CYAN  :=
+  RESET :=
+else
+  BOLD  := \033[1m
+  CYAN  := \033[36m
+  RESET := \033[0m
+endif
+
+BANNER = @printf "$(BOLD)$(CYAN)[target: $@]$(RESET)\n"
+
+DOCKER_BUILD = docker build $(MK_DOCKER_PULL) \
+    --progress=$(MK_DOCKER_PROGRESS) \
+    --build-arg MK_REPO_ID \
+    --build-arg MK_HOST_ARCH \
+    -f $(ROOT)/Dockerfile $(ROOT)
 
 .DEFAULT_GOAL := ci
 
-.PHONY: $(TARGETS)
+.PHONY: ci build test validate validate-ci package package-lvmplugin package-lvm-provisioner package-lvm-webhook gen-version-env clean clean-all
+
+# ---- gen-version-env ----
+# Pre-generate version env for container builds (no .git needed inside Docker).
+# Also handles git worktree checkouts where .git is a pointer file to an external directory.
+gen-version-env:
+	@bash $(ROOT)/scripts/version > /dev/null
+
+# ---- ci ----
+ci: build test validate validate-ci package
+
+# ---- build ----
+build: gen-version-env | $(ROOT)/bin
+	$(BANNER)
+	$(DOCKER_BUILD) --target build-output \
+	    --output type=local,dest=$(ROOT)
+
+# ---- test ----
+test: gen-version-env
+	$(BANNER)
+	$(DOCKER_BUILD) --target test
+
+# ---- validate ----
+validate: gen-version-env
+	$(BANNER)
+	$(DOCKER_BUILD) --target validate
+
+# ---- validate-ci ----
+validate-ci: gen-version-env
+	$(BANNER)
+	$(DOCKER_BUILD) --target validate-ci
+
+# ---- package ----
+package-lvmplugin:
+	$(BANNER)
+	ARCH=$(MK_HOST_ARCH) $(ROOT)/scripts/package_lvmplugin
+
+package-lvm-provisioner:
+	$(BANNER)
+	ARCH=$(MK_HOST_ARCH) $(ROOT)/scripts/package_lvm_provisioner
+
+package-lvm-webhook:
+	$(BANNER)
+	ARCH=$(MK_HOST_ARCH) $(ROOT)/scripts/package_lvm_webhook
+
+package: package-lvmplugin package-lvm-provisioner package-lvm-webhook
+
+$(ROOT)/bin:
+	mkdir -p $@
+
+# ---- clean ----
+clean:
+	@rm -rf $(ROOT)/bin
+	@rm -f $(ROOT)/scripts/.version_env
+
+clean-all: clean

scripts/version

@@ -1,5 +1,22 @@
 #!/bin/bash
 
+TOP_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+_VERSION_ENV="${TOP_DIR}/scripts/.version_env"
+
+# When .git is not available (container build or git worktree checkout where the
+# linked git dir is outside the Docker context), fall back to a pre-generated env
+# file.  Run 'scripts/version' or 'make gen-version-env' on a host with git access.
+if ! git -C "${TOP_DIR}" rev-parse HEAD &>/dev/null 2>&1; then
+    if [[ -f "${_VERSION_ENV}" ]]; then
+        # shellcheck source=/dev/null
+        source "${_VERSION_ENV}"
+        return 0 2>/dev/null || true
+    fi
+    echo "ERROR: git is unavailable and no pre-generated scripts/.version_env was found." >&2
+    echo "Run 'scripts/version' (or 'make gen-version-env') on a host with git access first." >&2
+    return 1 2>/dev/null || exit 1
+fi
+
 if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
     DIRTY="-dirty"
 fi
@@ -14,7 +31,7 @@ else
 fi
 
 if [ -z "$ARCH" ]; then
-    ARCH=$(go env GOHOSTARCH)
+    ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
 fi
 
 SUFFIX="-${ARCH}"
@@ -25,3 +42,16 @@ REPO=${REPO:-rancher}
 if echo $TAG | grep -q dirty; then
     TAG=dev
 fi
+
+cat > "${_VERSION_ENV}" <<__EOF__
+# Auto-generated by scripts/version — do not edit manually.
+# Refresh by running scripts/version (or 'make gen-version-env') on a host with git access.
+DIRTY="${DIRTY}"
+COMMIT="${COMMIT}"
+GIT_TAG="${GIT_TAG}"
+VERSION="${VERSION}"
+ARCH="${ARCH}"
+SUFFIX="${SUFFIX}"
+TAG="${TAG}"
+REPO="${REPO}"
+__EOF__