chore(deploy): pin musubi-core to v1.10.2 signed digest

[ericmey]

chore(deploy): pin musubi-core to v1.10.2 signed digest

Automated by .github/workflows/auto-digest-bump.yml in response to the v1.10.2 release.

Supply-chain attestations

• cosign keyless signature via GitHub OIDC
• CycloneDX SBOM attached as a cosign attestation
• Trivy vulnerability scan — 0 CRITICAL (gate in publish-core-image.yml)

Verify before deploy

cosign verify \
  --certificate-identity-regexp 'https://github.com/ericmey/musubi/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/ericmey/musubi-core@sha256:66a6749c068d8a7f29fba69fb0d4e72b22cbab4cac307192fc071735361a42a1

After merge

# From the ansible control host:
cd ~/musubi
git pull origin main
ANSIBLE_VAULT_PASSWORD_FILE=~/ansible/.vault_pass \
  ansible-playbook \
    -i deploy/ansible/inventory.yml \
    -e @~/.musubi-secrets/inventory-vars.yml \
    -e @~/.musubi-secrets/vault.yml \
    -e 'changed_services=["core","lifecycle-worker"]' \
    deploy/ansible/update.yml

No tracking Issue: auto-generated release digest pin.

[Copilot]

Pull request overview

Pins the deployed Musubi Core container image to the immutable, cosign-signed digest corresponding to the v1.10.2 release, ensuring production deployments track the exact published artifact.

Changes:

• Update musubi_core_image to the v1.10.2 GHCR digest.
• Bump musubi_core_version to v1.10.2 to keep dashboards/spans aligned with the deployed image.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.