chore(deploy): pin musubi-core to v1.11.5 signed digest

[ericmey]

chore(deploy): pin musubi-core to v1.11.5 signed digest

Automated by .github/workflows/auto-digest-bump.yml in response to the v1.11.5 release.

Supply-chain attestations

• cosign keyless signature via GitHub OIDC
• CycloneDX SBOM attached as a cosign attestation
• Trivy vulnerability scan — 0 CRITICAL (gate in publish-core-image.yml)

Verify before deploy

cosign verify \
  --certificate-identity-regexp 'https://github.com/ericmey/musubi/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/ericmey/musubi-core@sha256:e2d26acd9dd32644d67b8cc5118eeb9945d5dd0b30decbdfb4b2f33b4818bef4

After merge

# From the ansible control host:
cd ~/musubi
git pull origin main
ANSIBLE_VAULT_PASSWORD_FILE=~/ansible/.vault_pass \
  ansible-playbook \
    -i deploy/ansible/inventory.yml \
    -e @~/.musubi-secrets/inventory-vars.yml \
    -e @~/.musubi-secrets/vault.yml \
    -e 'changed_services=["core","lifecycle-worker"]' \
    deploy/ansible/update.yml

No tracking Issue: auto-generated release digest pin.

[Copilot]

Pull request overview

Pins the Ansible deployment configuration to the newly released musubi-core container image digest and updates the corresponding human-readable version tag, aligning runtime deployments with the signed/attested v1.11.5 release artifact.

Changes:

• Update musubi_core_image to ghcr.io/ericmey/musubi-core@sha256:e2d26acd9dd32644d67b8cc5118eeb9945d5dd0b30decbdfb4b2f33b4818bef4.
• Bump musubi_core_version from v1.11.4 to v1.11.5.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.