Description of problem: Despite updates-testing has explicitly been disabled permanently, Dnf persists to upgrade packages according to updates-testing repository.
Version-Release number of component: dnf.noarch 2.7.5-12.fc28 @updates-testing
Steps to Reproduce in terminal (In Finnish):
1. # dnf config-manager --set-disabled updates-testing
lähdetunnus lähdenimi tila
*fedora Fedora 28 - x86_64 57 317
*updates Fedora 28 - x86_64 - Updates 1 281
$ dnf repolist
2. # dnf distro-sync
# dnf clean all
# dnf -y autoremove
3. # dnf --refresh -y upgrade
Actual results: In step .1 and step .2 there is no mention of 'updates-testing', though packages from that repository are still listed as installed; Check,
$ dnf list installed
In step 3. Dnf upgrades packages according to updates-testing repository.
Expected results: Updates to be from current update repository.
Additional info: In step 3. Dnfdragora deals with updates the way Dnf does.
If installed package has same NEVRA (name, epoch, version, release, and arch) as available package, distro-sync command do not reinstall it, therefore the original repo (update-testing) is correctly mentioned.
I believe that this not a bug. DNF predict that packages with same name-epoch:version-release.arch have the same content, therefore there is no need to reinstall it. Especially in your case, where package that are in update-testing repo are then moved into update repository if no issue discovered. If package is broken and removed from testing repository, then the new package cannot have the same NEVRA. This is ensured by infrastructure. Anyway thanks for your report.