If you include the "apt" recipe, you do not need to create the execute [apt-get upgrade -y] resource. Or if you do not want to include the recipe "apt", use
execute "apt-get upgrade -y" do command "apt-get upgrade -y" action :run end
But since run is the default action, and the name is the default command, which can be shortened to
execute "apt-get upgrade -y"
source share