fix(ci) - remove debian:11 from CI test matrices (EOL)

[Venkumahanti Subhankar (V-Subhankar-infy)]

Problem

Every PR touching any Feature gets red test (<feature>, debian:11) jobs.

Debian 11 reached EOL on 2026-08-31. Its security archive stopped being re-signed
that day, and APT release files are valid for 7 days, so the metadata expired on
2026-09-07. Feature install.sh scripts run under set -e and install apt
prerequisites first, so every Feature fails identically. This is permanent, not a
flake; re-running will not help.

Verified 2026-09-09:

$ docker run --rm debian:11 sh -c 'apt-get update >/dev/null 2>&1; echo EXIT=$?'
EXIT=100
E: Release file for .../bullseye-security/InRelease is expired
$ docker run --rm debian:12 sh -c 'apt-get update >/dev/null 2>&1; echo EXIT=$?'
EXIT=0

Change

Removes "debian:11" from the baseImage matrix in test-pr.yaml and
test-all.yaml. No exclude: entries referenced it.

This removes CI coverage only. No Feature drops Debian 11 support: no
install.sh, no devcontainer-feature.json, and no Feature version is touched.

test-pr-arm64.yaml already excludes debian:11 and anticipated this EOL date, so
this just makes the amd64 matrices consistent with it.

Alternatives considered

• Acquire::Check-Valid-Until=false: disables APT freshness and signature checks
  repo-wide to paper over an EOL image.
• archive.debian.org: keeps CI validating an unsupported distro, and the host is
  rate-limited and unsuited to CI load.
• Nothing, since these jobs are continue-on-error: true: trains contributors to
  ignore red checks.

Follow-up (out of scope)

14 scenarios across 7 Features still pin bullseye images in their own
scenarios.json. Those run in test-scenarios, which ignores this matrix, so
they are a separate pre-existing failure best fixed in its own PR.

[Copilot]

🟢 Approval recommended

The change cleanly removes an EOL base image from CI matrices without leaving any dangling exclude references or altering feature support.

Pull request overview

This PR updates the GitHub Actions CI test matrices to stop running Feature tests on debian:11, which is now EOL and causes deterministic apt-get update failures due to expired release metadata.

Changes:

• Removed debian:11 from the baseImage matrix in the PR workflow (test-pr.yaml).
• Removed debian:11 from the baseImage matrix in the full test workflow (test-all.yaml).
• Kept existing matrix exclude: entries intact (none referenced debian:11).

File summaries

File	Description
.github/workflows/test-pr.yaml	Drops debian:11 from the PR test matrix to prevent permanent red CI runs.
.github/workflows/test-all.yaml	Drops debian:11 from the full test matrix to keep CI coverage aligned with supported base images.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.