build: migrate from Dapper to single-Dockerfile build system

Replace the Dapper-based build system (Dockerfile.dapper + scripts/entry
+ .dapper download) with a single root Dockerfile driven directly from
the Makefile via `docker build --target <stage>`.

Dockerfile:
- Add builder stage from registry.suse.com/bci/golang:1.26 with all
  tooling (git, docker, golangci-lint v2.12.2, controller-gen v0.17.1,
  openapi-gen v0.29.13)
- Add base stage (COPY . .) with WORKDIR/HOME set to the Go module path
- Add build stage + build-output scratch stage (cross-compiles amd64/arm64)
- Add validate stage (golangci-lint + go fmt)
- Add validate-ci stage with git-init trick for dirty-check after go generate
- Add test stage (go test)
- Add generate-manifest stage + generate-manifest-output scratch stage
  (controller-gen, no Go cache mounts needed)

Makefile:
- Replace dapper download/invocation with docker build --target <stage>
- Add standard MK_* variables (MK_HOST_ARCH, MK_REPO_ID, MK_DOCKER_PROGRESS,
  MK_DOCKER_PULL, MK_DOCKER_RUN_OPTS_TTY pattern via DOCKER_BUILD)
- Add gen-version-env prerequisite to all DOCKER_BUILD targets
- Set .DEFAULT_GOAL := ci (matching the old Dapper CMD)
- package target remains host-side: ARCH=$(MK_HOST_ARCH) ./scripts/package
- Add clean / clean-all targets

scripts/version:
- Add TOP_DIR + git availability guard with .version_env fallback for
  container builds and git worktree checkouts
- Replace `go env GOHOSTARCH` with `uname -m | sed ...` (host may lack Go)
- Write scripts/.version_env after all variables are computed
- Move BUILD_FOR_CI early-return after the env file write

.dockerignore:
- Add .git (stages needing git use git-init trick inside the stage)
- Preserve ./.dapper and /.cache entries
- Document that /bin is intentionally not excluded (package/Dockerfile
  uses COPY bin/... with repo root as build context)

.gitignore:
- Add scripts/.version_env (generated artifact, must not be committed)

Delete orchestration scripts (replaced by Makefile targets):
- scripts/ci, scripts/default, scripts/entry, scripts/release

Signed-off-by: Kiefer Chang <kiefer.chang@suse.com>

Author: bk201

.dockerignore

@@ -1,2 +1,11 @@
+# git dir is excluded to avoid passing the entire git object database through
+# the build context; stages that need git use git-init inside the stage.
+.git
+
 ./.dapper
-./.cache
+/.cache
+*.swp
+.idea/
+
+# /bin is intentionally NOT excluded because `make package` uses the project root
+# as docker build context and package/Dockerfile does COPY bin/...

.gitignore

@@ -3,3 +3,4 @@
 /bin
 *.swp
 .idea
+scripts/.version_env

Dockerfile

@@ -0,0 +1,66 @@
+FROM registry.suse.com/bci/golang:1.26 AS builder
+ARG MK_HOST_ARCH
+ENV ARCH=$MK_HOST_ARCH
+
+RUN zypper -n rm container-suseconnect && \
+    zypper -n install git curl docker gzip tar wget awk docker-buildx
+
+COPY --from=golangci/golangci-lint:v2.12.2-alpine@sha256:91b27804074a0bacea298707f016911e60cf0cdbc6c7bf5ccacb5f0606d18d60 /usr/bin/golangci-lint /usr/local/bin/golangci-lint
+
+RUN go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.17.1
+
+RUN go install k8s.io/code-generator/cmd/openapi-gen@v0.29.13
+
+ENV HOME=/go/src/github.com/harvester/networkfs-manager
+
+# ---- base ----
+FROM builder AS base
+WORKDIR /go/src/github.com/harvester/networkfs-manager
+COPY . .
+
+# ---- build ----
+FROM base AS build
+ARG MK_REPO_ID
+
+RUN --mount=type=cache,target=/go/pkg/mod,id=networkfs-manager-go-mod-${MK_REPO_ID} \
+    --mount=type=cache,target=/go/src/github.com/harvester/networkfs-manager/.cache/go-build,id=networkfs-manager-go-build-${MK_REPO_ID} \
+    ./scripts/build
+
+FROM scratch AS build-output
+COPY --from=build /go/src/github.com/harvester/networkfs-manager/bin/ /bin/
+
+# ---- validate ----
+FROM base AS validate
+ARG MK_REPO_ID
+
+RUN --mount=type=cache,target=/go/pkg/mod,id=networkfs-manager-go-mod-${MK_REPO_ID} \
+    --mount=type=cache,target=/go/src/github.com/harvester/networkfs-manager/.cache/go-build,id=networkfs-manager-go-build-${MK_REPO_ID} \
+    ./scripts/validate
+
+# ---- validate-ci ----
+FROM base AS validate-ci
+ARG MK_REPO_ID
+
+RUN git config --global user.email "ci@example.com" && \
+    git config --global user.name "ci" && \
+    git init 2>/dev/null && git add . && git commit -q -m "commit for validate-ci"
+
+RUN --mount=type=cache,target=/go/pkg/mod,id=networkfs-manager-go-mod-${MK_REPO_ID} \
+    --mount=type=cache,target=/go/src/github.com/harvester/networkfs-manager/.cache/go-build,id=networkfs-manager-go-build-${MK_REPO_ID} \
+    ./scripts/validate-ci
+
+# ---- test ----
+FROM base AS test
+ARG MK_REPO_ID
+
+RUN --mount=type=cache,target=/go/pkg/mod,id=networkfs-manager-go-mod-${MK_REPO_ID} \
+    --mount=type=cache,target=/go/src/github.com/harvester/networkfs-manager/.cache/go-build,id=networkfs-manager-go-build-${MK_REPO_ID} \
+    ./scripts/test
+
+# ---- generate-manifest ----
+FROM base AS generate-manifest
+
+RUN ./scripts/generate-manifest
+
+FROM scratch AS generate-manifest-output
+COPY --from=generate-manifest /go/src/github.com/harvester/networkfs-manager/manifests/ /manifests/

Dockerfile.dapper

@@ -1,26 +1,89 @@
-TARGETS := $(shell ls scripts)
-
-SHA512SUM_Linux_aarch64 := 781951b31e5ff018a04e755c6da7163b31a81edda61f1bed4def8d0e24229865c58a3d26aa0cc4184058d91ebcae300ead2cad16d3c46ccb1098419e3e41a016
-SHA512SUM_Linux_x86_64 := d2ec27ecf9362e2fafd27d76d85a5c5b92b53aefe07cffa76bf9887db6bee07b1023cca8fc32a2c9bdd2ecfadaee71397066b41bd37c9ebbbbce09913f0884d4
-SHA512SUM_Darwin_arm64 := 8a356c89ad32af1698ae8615a6e303773a8ac58b114368454d59965ec2aa8282e780d1e228d37c301ce6f87596f68bfe7f204eb5f4c019c386a58dd94153ddcf
-SHA512SUM_Darwin_x86_64 := dbab05de04dda26793f4ae7875d0fba96ee54b0228e192fd40c0b2116ed345b5444047fc2e0c90cb481f28cbe0e0452bcecb268c8d074cd8615eb2f5463c30b6
-SHA512SUM_Windows_x86_64 := 807aee2f68b6da35cb0885558f5cbc9a6c8747a56c7a200f0e1fcac9e2fd0da570cbb39e48b3192bd1a71805f2ab38fd19d77faebba97a89e5d9a8b430ee429e
-
-.dapper:
-	@echo Downloading dapper
-	@curl -sL https://releases.rancher.com/dapper/v0.6.0/dapper-`uname -s`-`uname -m` > .dapper.tmp
-	@CHECKSUM=$$(shasum -a 512 .dapper.tmp | awk '{print $$1}'); \
-	if [ "$$CHECKSUM" != "$(SHA512SUM_$(shell uname -s)_$(shell uname -m))" ]; then \
-		echo "Checksum verification failed!"; \
-		exit 1; \
-	fi
-	@@chmod +x .dapper.tmp
-	@./.dapper.tmp -v
-	@mv .dapper.tmp .dapper
-
-$(TARGETS): .dapper
-	./.dapper $@
-
-.DEFAULT_GOAL := default
-
-.PHONY: $(TARGETS)
+ROOT := $(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
+
+DOCKER_BUILDKIT := 1
+export DOCKER_BUILDKIT
+
+MK_HOST_ARCH ?= $(shell uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
+export MK_HOST_ARCH
+
+MK_REPO_ID := $(shell echo -n "$(ROOT)$$(cat /etc/machine-id 2>/dev/null)" | sha256sum | cut -c1-8)
+export MK_REPO_ID
+
+MK_DOCKER_PROGRESS ?= plain
+export MK_DOCKER_PROGRESS
+
+MK_DOCKER_PULL ?= --pull
+export MK_DOCKER_PULL
+
+ifdef CI
+  BOLD  :=
+  CYAN  :=
+  RESET :=
+else
+  BOLD  := \033[1m
+  CYAN  := \033[36m
+  RESET := \033[0m
+endif
+
+BANNER = @printf "$(BOLD)$(CYAN)[target: $@]$(RESET)\n"
+
+DOCKER_BUILD = docker build $(MK_DOCKER_PULL) \
+    --progress=$(MK_DOCKER_PROGRESS) \
+    --build-arg MK_REPO_ID \
+    --build-arg MK_HOST_ARCH \
+    -f $(ROOT)/Dockerfile $(ROOT)
+
+.DEFAULT_GOAL := ci
+
+.PHONY: ci build test validate validate-ci generate-manifest package gen-version-env clean clean-all
+
+# ---- gen-version-env ----
+# Pre-generate version env for container builds (no .git needed inside Docker).
+# Also handles git worktree checkouts where .git is a pointer file to an external directory.
+gen-version-env:
+	@bash $(ROOT)/scripts/version > /dev/null
+
+# ---- ci ----
+ci: build test validate validate-ci package
+
+# ---- build ----
+build: gen-version-env | $(ROOT)/bin
+	$(BANNER)
+	$(DOCKER_BUILD) --target build-output \
+	    --output type=local,dest=$(ROOT)
+
+# ---- test ----
+test: gen-version-env
+	$(BANNER)
+	$(DOCKER_BUILD) --target test
+
+# ---- validate ----
+validate: gen-version-env
+	$(BANNER)
+	$(DOCKER_BUILD) --target validate
+
+# ---- validate-ci ----
+validate-ci: gen-version-env
+	$(BANNER)
+	$(DOCKER_BUILD) --target validate-ci
+
+# ---- generate-manifest ----
+generate-manifest: gen-version-env
+	$(BANNER)
+	$(DOCKER_BUILD) --target generate-manifest-output \
+	    --output type=local,dest=$(ROOT)
+
+# ---- package ----
+package: build
+	$(BANNER)
+	ARCH=$(MK_HOST_ARCH) $(ROOT)/scripts/package
+
+$(ROOT)/bin:
+	mkdir -p $@
+
+# ---- clean ----
+clean:
+	@rm -rf $(ROOT)/bin
+	@rm -f $(ROOT)/scripts/.version_env
+
+clean-all: clean

Makefile

@@ -1,5 +1,22 @@
 #!/bin/bash
 
+TOP_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+_VERSION_ENV="${TOP_DIR}/scripts/.version_env"
+
+# When .git is not available (container build or git worktree checkout where the
+# linked git dir is outside the Docker context), fall back to a pre-generated env
+# file.  Run 'scripts/version' or 'make gen-version-env' on a host with git access.
+if ! git -C "${TOP_DIR}" rev-parse HEAD &>/dev/null 2>&1; then
+    if [[ -f "${_VERSION_ENV}" ]]; then
+        # shellcheck source=/dev/null
+        source "${_VERSION_ENV}"
+        return 0 2>/dev/null || true
+    fi
+    echo "ERROR: git is unavailable and no pre-generated scripts/.version_env was found." >&2
+    echo "Run 'scripts/version' (or 'make gen-version-env') on a host with git access first." >&2
+    return 1 2>/dev/null || exit 1
+fi
+
 if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
     DIRTY="-dirty"
 fi
@@ -14,18 +31,35 @@ else
 fi
 
 if [ -z "$ARCH" ]; then
-    ARCH=$(go env GOHOSTARCH)
+    ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
 fi
 
 SUFFIX="-${ARCH}"
 
 TAG=${TAG:-${VERSION}${SUFFIX}}
 REPO=${REPO:-harvester}
+
 if [[ -n ${BUILD_FOR_CI} ]]; then
-  TAG=${COMMIT}
-  return
+    TAG=${COMMIT}
 fi
 
-if echo $TAG | grep -q dirty; then
+if echo "$TAG" | grep -q dirty; then
     TAG=dev
 fi
+
+cat > "${_VERSION_ENV}" <<__EOF__
+# Auto-generated by scripts/version — do not edit manually.
+# Refresh by running scripts/version (or 'make gen-version-env') on a host with git access.
+DIRTY="${DIRTY}"
+COMMIT="${COMMIT}"
+GIT_TAG="${GIT_TAG}"
+VERSION="${VERSION}"
+ARCH="${ARCH}"
+SUFFIX="${SUFFIX}"
+TAG="${TAG}"
+REPO="${REPO}"
+__EOF__
+
+if [[ -n ${BUILD_FOR_CI} ]]; then
+    return 0 2>/dev/null || true
+fi