fix: upgrade OS packages in runtime stage to pick up Alpine security patches (#17)

The runtime stage only installed packages with `apk add --no-cache` and never
ran `apk upgrade`, so already-present base-image packages were patched only when
the Alpine base tag was bumped (via Renovate). Between bumps the shipped image
could carry OS packages with known CVEs even though fixed versions were already
available in the Alpine repository, surfacing as Trivy HIGH/CRITICAL findings.

Add `apk upgrade --no-cache` to the runtime stage so the final image picks up
Alpine security patches at build time. The builder stages are throwaway and do
not affect the shipped image's CVE surface, so they are left unchanged.

Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: DeepDiver1975

README.md

@@ -69,7 +69,7 @@ The image is built entirely from source via a three-stage Dockerfile:
 
 **`go-builder`** — compiles the oCIS binary with CGO and libvips enabled using the upstream Makefile target `release-linux-docker-${TARGETARCH}`. Outputs to `dist/binaries/ocis-linux-${TARGETARCH}`.
 
-**Runtime** — minimal Alpine image with the binary copied from `go-builder`.
+**Runtime** — minimal Alpine image with the binary copied from `go-builder`. The stage runs `apk upgrade` to refresh all installed OS packages to the latest available Alpine patch releases at build time, so security fixes are picked up immediately rather than waiting for a base-image tag bump.
 
 To build locally:
 

v8/Dockerfile.multiarch

@@ -69,7 +69,8 @@ LABEL maintainer="ownCloud GmbH <devops@owncloud.com>" \
   org.opencontainers.image.version="${VERSION}" \
   org.opencontainers.image.revision="${REVISION}"
 
-RUN apk add --no-cache attr bash ca-certificates curl inotify-tools libc6-compat mailcap tree vips patch && \
+RUN apk upgrade --no-cache && \
+  apk add --no-cache attr bash ca-certificates curl inotify-tools libc6-compat mailcap tree vips patch && \
   echo 'hosts: files dns' >| /etc/nsswitch.conf
 
 RUN addgroup -g 1000 -S ocis-group && \