TT-18284: drop debian:bullseye from the upgrade-test distro matrix

[konrad-sol]

Fixes TT-18284.

Why

Debian 11 reached end of LTS and its security Release file expired on 2026-09-07:

E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease
   is expired (invalid since 1d 12h 37min 24s)

apt-get update now exits 100 inside debian:bullseye before any Tyk package is
installed, so the upgrade-deb leg fails for every gromit-managed repo. Observed
today on tyk-pump, tyk-sink, portal and tyk-identity-broker; tyk passed the same leg
on 2026-09-07, which brackets the expiry.

Because the matrix uses fail-fast: true, that single leg also cancels the other 25
healthy distro legs, so failures currently read as "1 failed, 14 cancelled" and tell
you nothing about the rest.

Coverage

Debian stays covered by debian:bookworm (12) and debian:trixie (13). Nothing is
lost — this is a deletion, not a swap.

Follow-ups, deliberately not in this PR

• fail-fast: false on the three matrices in upgrade-tests.yml, so one bad
  distro stops hiding the other 25. Independent of Bullseye; worth its own change.
• ubuntu:focal is in the same position — Ubuntu 20.04 standard support ended
  April 2025. Worth deciding rather than discovering.
• from_ver has no default for portal or tyk-identity-broker, so
  upgrade-tests.yml generates apt-get install -y tyk-identity-broker= and falls
  through || echo "Previous version not found, testing fresh install". Those two
  repos' upgrade tests have never tested an upgrade and pass green. Needs a product
  decision on baseline versions.

🤖 Generated with Claude Code

[github-actions]

zizmor findings

Severity	Count
High	90
Medium	88
Low	2
Info	11

Full details are in the workflow run.

[probelabs]

This PR removes Debian 11 (Bullseye) from the upgrade test matrix in response to its End-of-Life (EOL). The expired security release file for Bullseye was causing apt-get update to fail, which in turn blocked all CI upgrade tests due to the fail-fast: true configuration in the test matrix.

Files Changed Analysis

The change is isolated to a single file, .github/actions/tests/distro-matrix/action.yaml. It involves the removal of "debian:bullseye" from the hardcoded list of Debian-based distributions, reducing the test matrix for .deb packages.

Architecture & Impact Assessment

• What this PR accomplishes: It resolves a critical CI blockage by removing an EOL distribution (Debian 11) from the test suite. This allows the upgrade test pipeline to run to completion, restoring visibility into the test outcomes for the remaining supported distributions.

• Key technical changes introduced: The PR modifies the GitHub Action responsible for generating the distribution matrix. Specifically, it removes debian:bullseye from the JSON array of deb distributions that is output by the action.

• Affected system components: The change directly impacts the .github/actions/tests/distro-matrix action and any CI workflow that consumes it. The primary consumer is the upgrade-tests.yml reusable workflow, which uses this matrix to run upgrade tests across various operating systems. By fixing this, CI pipelines for multiple repositories that use this workflow are unblocked.

Scope Discovery & Context Expansion

• The scope is limited to the CI configuration of this repository, specifically the distro-matrix GitHub Action. The search confirms that this action's output is consumed by the upgrade-tests.yml reusable workflow, which is likely called by other repositories, meaning this fix will propagate to them.
• The PR author correctly notes several important, related issues that are deliberately not addressed here:
  • The fail-fast: true setting should be revisited to prevent a single distro failure from hiding the results of others.
  • ubuntu:focal (Ubuntu 20.04) is also approaching its EOL and should be evaluated for removal.
  • Two repositories, portal and tyk-identity-broker, have upgrade tests that may not be correctly configured to test upgrades, instead performing fresh installs.

Metadata

• Review Effort: 1 / 5
• Primary Label: chore

---

Powered by Visor from Probelabs

Last updated: 2026-09-09T14:23:48.095Z | Triggered by: pr_opened | Commit: d9a89bb

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

✅ Security Check Passed

No security issues found – changes LGTM.

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

---

Powered by Visor from Probelabs

Last updated: 2026-09-09T14:23:28.001Z | Triggered by: pr_opened | Commit: d9a89bb

💡 TIP: You can chat with Visor using /visor ask <your question>