feat: Build csi-snapshot-metadata in Dockerfile builder stage

Refactors the Dockerfile to build the csi-snapshot-metadata binary
from source in the builder stage, similar to how grpc_health_probe
is obtained (via ADD from remote URL).

Changes to cmd/csi-snapshot-metadata/Dockerfile:
- Use golang:1.24-alpine as builder base (was alpine)
- Add TARGETOS and LDFLAGS build arguments
- Copy Go source files (go.mod, go.sum, cmd/, pkg/, client/, vendor/)
- Build binary in builder with cross-compilation support
- Copy built binary from builder (was copying from host filesystem)
- Remove obsolete binary ARG

Changes to release-tools/build.make:
- Replace --build-arg binary with --build-arg LDFLAGS
- Remove build-% dependency from push-multiarch-% target
  (Docker now builds from source, eliminating duplicate compilation)
- Fix manifest error detection to handle both error formats:
  - "manifest for ... not found" (docker.io)
  - "manifest unknown" (ghcr.io, quay.io)

Benefits:
- Self-contained builds (no external Makefile dependency for Docker)
- True cross-compilation via Docker buildx
- Consistent approach (both binaries prepared in builder stage)
- Easier for contributors (just docker/podman build)

Tested with multiarch build to ghcr.io (amd64, arm64).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: kaovilai

cmd/csi-snapshot-metadata/Dockerfile

@@ -1,13 +1,27 @@
-FROM alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.24-alpine AS builder
 ARG GRPC_HEALTH_PROBE_VERSION=v0.4.37
-ADD https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/${GRPC_HEALTH_PROBE_VERSION}/grpc_health_probe-linux-amd64 /bin/grpc_health_probe
+ARG TARGETARCH
+ARG TARGETOS=linux
+ARG LDFLAGS
+ADD https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/${GRPC_HEALTH_PROBE_VERSION}/grpc_health_probe-linux-${TARGETARCH} /bin/grpc_health_probe
 RUN chmod +x /bin/grpc_health_probe
 
+# Build csi-snapshot-metadata
+WORKDIR /workspace
+COPY go.mod go.sum ./
+COPY cmd/ cmd/
+COPY pkg/ pkg/
+COPY client/ client/
+COPY vendor/ vendor/
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
+    go build -mod=vendor -a -ldflags "${LDFLAGS}" \
+    -o /bin/csi-snapshot-metadata \
+    ./cmd/csi-snapshot-metadata
+
 FROM gcr.io/distroless/static:latest
 LABEL maintainers="Kubernetes Authors"
 LABEL description="CSI External Snapshot Metadata Sidecar"
-ARG binary=./bin/csi-snapshot-metadata
 COPY --from=builder /bin/grpc_health_probe /bin/grpc_health_probe
-COPY ${binary} csi-snapshot-metadata
+COPY --from=builder /bin/csi-snapshot-metadata /csi-snapshot-metadata
 ENTRYPOINT ["/csi-snapshot-metadata"]
 

release-tools/build.make

@@ -146,7 +146,7 @@ DOCKER_BUILDX_CREATE_ARGS ?=
 # BUILD_PLATFORMS determines which individual images are included in the multiarch image.
 # PULL_BASE_REF must be set to 'master', 'main', 'release-x.y', or a tag name, and determines
 # the tag for the resulting multiarch image.
-$(CMDS:%=push-multiarch-%): push-multiarch-%: check-pull-base-ref build-%
+$(CMDS:%=push-multiarch-%): push-multiarch-%: check-pull-base-ref
 	set -ex; \
 	export DOCKER_CLI_EXPERIMENTAL=enabled; \
 	docker buildx create $(DOCKER_BUILDX_CREATE_ARGS) --use --name multiarchimage-buildertest --driver-opt image=moby/buildkit:v0.10.6; \
@@ -167,7 +167,7 @@ $(CMDS:%=push-multiarch-%): push-multiarch-%: check-pull-base-ref build-%
 				--tag $(IMAGE_NAME):$$escaped_buildx_platform-$$os-$$escaped_base_image$$tag \
 				--platform=$$os/$$buildx_platform \
 				--file $$(eval echo \$${dockerfile_$$os}) \
-				--build-arg binary=./bin/$*$$suffix \
+				--build-arg LDFLAGS='$(FULL_LDFLAGS)' \
 				--build-arg ARCH=$$arch \
 				--build-arg BASE_IMAGE=$$base_image \
 				--build-arg ADDON_IMAGE=$$addon_image \
@@ -199,7 +199,7 @@ $(CMDS:%=push-multiarch-%): push-multiarch-%: check-pull-base-ref build-%
 			: "creating or overwriting canary image for release branch"; \
 			release_canary_tag=$$(echo $(PULL_BASE_REF) | cut -f2 -d '-')-canary; \
 			pushMultiArch $$release_canary_tag; \
-	elif docker pull $(IMAGE_NAME):$(PULL_BASE_REF) 2>&1 | tee /dev/stderr | grep -q "manifest for $(IMAGE_NAME):$(PULL_BASE_REF) not found"; then \
+	elif docker pull $(IMAGE_NAME):$(PULL_BASE_REF) 2>&1 | tee /dev/stderr | grep -qE "(manifest for .* not found|manifest unknown)"; then \
 			: "creating release image"; \
 			pushMultiArch $(PULL_BASE_REF); \
 	else \