fix(ci) - remove debian:11 from CI test matrices (EOL) by V-Subhankar-infy · Pull Request #1736 · devcontainers/features · GitHub
Skip to content

fix(ci) - remove debian:11 from CI test matrices (EOL) - #1736

Merged
Abdurrahmaan Iqbal (abdurriq) merged 3 commits into
devcontainers:mainfrom
V-Subhankar-infy:fix-stale-variants
Sep 16, 2026
Merged

Abdurrahmaan Iqbal (abdurriq) merged 3 commits into
devcontainers:mainfrom
V-Subhankar-infy:fix-stale-variants

Conversation

@V-Subhankar-infy

@V-Subhankar-infy Venkumahanti Subhankar (V-Subhankar-infy) commented Sep 9, 2026 •

Copy link
Copy Markdown
Member

Problem

Every PR touching any Feature gets red test (<feature>, debian:11) and bullseye test-scenarios jobs.

Debian 11 reached EOL on 2026-08-31. Its security archive stopped being re-signed that day, and APT release files are valid for 7 days, so the metadata expired on 2026-09-07. Feature install.sh scripts run under set -e and install apt prerequisites first, so every Feature fails identically. This is permanent, not a flake; re-running will not help.

Verified 2026-09-09:

$ docker run --rm debian:11 sh -c 'apt-get update >/dev/null 2>&1; echo EXIT=$?'
EXIT=100
E: Release file for .../bullseye-security/InRelease is expired
$ docker run --rm debian:12 sh -c 'apt-get update >/dev/null 2>&1; echo EXIT=$?'
EXIT=0

Change

CI matrices: removes "debian:11" from the baseImage matrix in test-pr.yaml and test-all.yaml (no exclude: entries referenced it). test-pr-arm64.yaml already excluded debian:11 and anticipated this EOL date, so this just makes the amd64 matrices consistent with it.

Test scenarios: clears the 14 remaining bullseye/debian:11 pins across 7 Features that run in test-scenarios. Bullseye-only scenarios and their test scripts are removed (anaconda, common-utils, git); the rest are retargeted to bookworm/debian:12 (azure-cli, common-utils, java, node, python).

This drops CI coverage of an EOL image only. No Feature drops Debian 11 support: no install.sh, no devcontainer-feature.json, and no Feature version is touched.

Alternatives considered

• Acquire::Check-Valid-Until=false: disables APT freshness and signature checks repo-wide to paper over an EOL image.
• archive.debian.org: keeps CI validating an unsupported distro, and the host is rate-limited and unsuited to CI load.
• Nothing: the jobs are continue-on-error: true, so they don't block merges — but every PR still burns a full matrix leg on a guaranteed failure, and a standing red X hides real regressions in those same jobs.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The change cleanly removes an EOL base image from CI matrices without leaving any dangling exclude references or altering feature support.

Pull request overview

This PR updates the GitHub Actions CI test matrices to stop running Feature tests on debian:11, which is now EOL and causes deterministic apt-get update failures due to expired release metadata.

Changes:

  • Removed debian:11 from the baseImage matrix in the PR workflow (test-pr.yaml).
  • Removed debian:11 from the baseImage matrix in the full test workflow (test-all.yaml).
  • Kept existing matrix exclude: entries intact (none referenced debian:11).
File summaries
File Description
.github/workflows/test-pr.yaml Drops debian:11 from the PR test matrix to prevent permanent red CI runs.
.github/workflows/test-all.yaml Drops debian:11 from the full test matrix to keep CI coverage aligned with supported base images.
Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@abdurriq
Abdurrahmaan Iqbal (abdurriq) merged commit f3ca13b into devcontainers:main Sep 16, 2026
41 checks passed
Daniel Glaser (the78mole) added a commit to the78mole/features that referenced this pull request Sep 19, 2026
The add-groups scenario pinned debian:bullseye. Debian 11 is end-of-life
and its security pool is no longer served, so the scenario now fails while
installing sudo/git/gnupg2:

  E: Failed to fetch http://deb.debian.org/debian-security/pool/updates/
     main/s/sudo/sudo_1.9.5p2-3+deb11u4_amd64.deb

Upstream removed debian:11 from the CI matrices for this reason (devcontainers#1736);
this was the last reference left in the repository. Switched to
debian:trixie, already the most used Debian image in this scenario file.
Nothing in add-groups.sh is release-specific.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Abdurrahmaan Iqbal (abdurriq) pushed a commit that referenced this pull request Sep 25, 2026
* Initial plan

* Add ohMyZshTheme option to common-utils feature

Co-authored-by: the78mole <7723396+the78mole@users.noreply.github.com>

* Add test scenario for custom zsh theme

Co-authored-by: the78mole <7723396+the78mole@users.noreply.github.com>

* Add validation for theme name to prevent injection attacks

Co-authored-by: the78mole <7723396+the78mole@users.noreply.github.com>

* Bump version from 2.5.7 to 2.5.8

* Add support for additional non-root user groups in common-utils feature

* Bump version to 2.6.0 in devcontainer feature

* "Add/update ko-fi sponsorship to $KOIFI"

* Fix FUNDING.yml: ko-fi -> ko_fi (underscore)

* common-utils: drop stray FUNDING.yml, bump to 2.7.0

The FUNDING.yml was added to this fork by accident and never belonged in
PR #1564. It was malformed anyway — the first line
held two U+FFFD replacement characters left over from an unexpanded shell
variable. Upstream carries no FUNDING.yml, so the file is simply removed.

Bump common-utils 2.6.0 -> 2.7.0: upstream released `sudoers` as 2.6.0,
while this fork's 2.6.0 already carried `ohMyZshTheme` and `addGroups`.
After the merge the same version number would describe two different
option sets, so the merged feature needs its own version.

* test(common-utils): move add-groups scenario off EOL debian:11

The add-groups scenario pinned debian:bullseye. Debian 11 is end-of-life
and its security pool is no longer served, so the scenario now fails while
installing sudo/git/gnupg2:

  E: Failed to fetch http://deb.debian.org/debian-security/pool/updates/
     main/s/sudo/sudo_1.9.5p2-3+deb11u4_amd64.deb

Upstream removed debian:11 from the CI matrices for this reason (#1736);
this was the last reference left in the repository. Switched to
debian:trixie, already the most used Debian image in this scenario file.
Nothing in add-groups.sh is release-specific.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* test(common-utils): use debian:bookworm for add-groups scenario

Follow-up to the previous commit, which moved the scenario off EOL
debian:bullseye to debian:trixie. A maintainer asked for bookworm (12)
in review, so use that instead:

  #1564 (review comment on scenarios.json:139)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Kaniska <kaniska244@github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants