It should be enough to just rebuild the image to track changes from _/alpine and manually release tags for some updates. Normally we don't need to release tags for updates like 3.8.2 because we always receive latest packages with apk --update.
We release git tags without knowing whether the build will pass/fail, we should somehow check that whether the build for the branch from which we create tags has passed.