UU ignores my repo selected in Origins-Pattern

[Danethz]

Hello!

Debian 11.2 Unattended-Upgrades 2.8

I have 2 local repos and official Debian repo:

 100 /var/lib/dpkg/status
     release a=now
 700 https://my.repo.local/debian11-main-test bullseye/main amd64 Packages
     release o=Debian,a=bullseye,n=bullseye,l=my.repo.local-test,c=main,b=amd64
     origin my.repo.local
 950 https://my.repo.local/debian11-security-test bullseye-security/main amd64 Packages
     release o=Debian,a=bullseye-security,n=bullseye-security,l=my.repo.local-test,c=main,b=amd64
     origin my.repo.local
 500 http://security.debian.org bullseye-security/main amd64 Packages
     release v=11,o=Debian,a=stable-security,n=bullseye-security,l=Debian-Security,c=main,b=amd64
     origin security.debian.org

Release file from my repo:

Origin: Debian
Label: my.repo.local-test
Suite: bullseye-security
Codename: bullseye-security
Date: Sun, 29 Jan 2023 23:13:44 UTC
Architectures: amd64
Components: main
Description: Generated by aptly

I want UU install update only from https://my.repo.local/debian11-security-test and codename bullseye-security: My 50unattended-upgrades:

Unattended-Upgrade::Origins-Pattern {
        "origin=Debian,codename=${distro_codename}-security,label=my.repo.local-test";
};

But when I run UU in debug mode I see it downloads from http://security.debian.org:

<apt_pkg.AcquireItem object:Status: 2 Complete: 1 Local: 1 IsTrusted: 1 FileSize: 55519352 DestFile:'/var/cache/apt/archives/linux-image-5.10.0-21-amd64_5.10.162-1_amd64.deb' DescURI: 'http://security.debian.org/pool/updates/main/l/linux-signed-amd64/linux-image-5.10.0-21-amd64_5.10.162-1_amd64.deb' ID:0 ErrorText: ''>
check_conffile_prompt(/var/cache/apt/archives/linux-image-5.10.0-21-amd64_5.10.162-1_amd64.deb)
No conffiles in deb /var/cache/apt/archives/linux-image-5.10.0-21-amd64_5.10.162-1_amd64.deb (There is no member named 'conffiles')
<apt_pkg.AcquireItem object:Status: 2 Complete: 1 Local: 1 IsTrusted: 1 FileSize: 1484 DestFile:'/var/cache/apt/archives/linux-image-amd64_5.10.162-1_amd64.deb' DescURI: 'http://security.debian.org/pool/updates/main/l/linux-signed-amd64/linux-image-amd64_5.10.162-1_amd64.deb' ID:0 ErrorText: ''>
check_conffile_prompt(/var/cache/apt/archives/linux-image-amd64_5.10.162-1_amd64.deb)
found pkg: linux-image-amd64

When I comment out http://security.debian.org UU starts to use my repo:

<apt_pkg.AcquireItem object:Status: 2 Complete: 1 Local: 1 IsTrusted: 1 FileSize: 55519352 DestFile:'/var/cache/apt/archives/linux-image-5.10.0-21-amd64_5.10.162-1_amd64.deb' DescURI: 'https://my.repo.local/debian11-security-test/pool/main/l/linux-signed-amd64/linux-image-5.10.0-21-amd64_5.10.162-1_amd64.deb' ID:0 ErrorText: ''>
check_conffile_prompt(/var/cache/apt/archives/linux-image-5.10.0-21-amd64_5.10.162-1_amd64.deb)
No conffiles in deb /var/cache/apt/archives/linux-image-5.10.0-21-amd64_5.10.162-1_amd64.deb (There is no member named 'conffiles')
<apt_pkg.AcquireItem object:Status: 2 Complete: 1 Local: 1 IsTrusted: 1 FileSize: 1484 DestFile:'/var/cache/apt/archives/linux-image-amd64_5.10.162-1_amd64.deb' DescURI: 'https://my.repo.local/debian11-security-test/pool/main/l/linux-signed-amd64/linux-image-amd64_5.10.162-1_amd64.deb' ID:0 ErrorText: ''>
check_conffile_prompt(/var/cache/apt/archives/linux-image-amd64_5.10.162-1_amd64.deb)
found pkg: linux-image-amd64

Version of package the same in both repos:

linux-image-amd64:
  Installed: 5.10.84-1
  Candidate: 5.10.162-1
  Version table:
     5.10.162-1 500
        500 http://security.debian.org bullseye-security/main amd64 Packages
        950 https://my.repo.local/debian11-security-test bullseye-security/main amd64 Packages
     5.10.158-2 500
        700 https://my.repo.local/debian11-main-test bullseye/main amd64 Packages
 *** 5.10.84-1 100
        100 /var/lib/dpkg/status

Tried some tests (in all test http://security.debian.org was enabled): 1.

Unattended-Upgrade::Origins-Pattern {  
     "origin=Debian,codename=${distro_codename}-security,label=repo.local.com*";  
} 

None of the packages were updated as if no repository was enabled:

Checking: linux-image-amd64 ([<Origin component:'main' archive:'stable-security' origin:'Debian' label:'Debian-Security' site:'security.debian.org' isTrusted:True>, <Origin component:'main' archive:'bullseye-security' origin:'Debian' label:'my.repo.local-test' site:'my.repo.local' isTrusted:True>])
adjusting candidate version: linux-image-amd64=5.10.84-1

2. Unattended-Upgrade::Origins-Pattern {  
    "label=repo.local.com-test";  
   } 

   Same result as previous test

3. Unattended-Upgrade::Origins-Pattern {  
    "site=repo.local.com";  
   }

   Same result as previous test

How can I make UU to install only security-update only from my repo but not disabling the official repo and use pinning preferences?