upgrade alpine packages during image build

apk add --upgrade leaves zlib from the pinned
base image in place. apk upgrade pulls the
patched package so the container scan does not
wait on a docker hub rebuild

Author: atkrad

Dockerfile

@@ -5,7 +5,8 @@ FROM --platform=$BUILDPLATFORM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f5
 ENV GO111MODULE=on
 ENV CGO_ENABLED=0
 COPY --from=xx / /
-RUN apk add --update --upgrade --no-cache build-base coreutils git
+RUN apk upgrade --no-cache \
+    && apk add --update --upgrade --no-cache build-base coreutils git
 WORKDIR /src
 
 FROM base AS build
@@ -39,7 +40,8 @@ FROM scratch AS artifact
 COPY --from=releaser /out /
 
 FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
-RUN apk add --update --upgrade --no-cache ca-certificates tzdata
+RUN apk upgrade --no-cache \
+    && apk add --update --upgrade --no-cache ca-certificates tzdata
 COPY --from=binary /deployah /usr/bin/deployah
 ENTRYPOINT ["deployah"]
 CMD ["--help"]