From 0277c8765a678eaafbda6f5eab307de28d663bf0 Mon Sep 17 00:00:00 2001
From: Rob Reed <github@linuxjunkie.com>
Date: Mon, 12 Oct 2026 09:23:36 -0700
Subject: [PATCH] [GHA] Disable upstream's security audit and release
 workflows.

The upstream syncs brought in a nightly security audit and left upstream's
release workflows active, most of which run on every pull request. None of
it applies to the fork: releases go through xelp_npm_release, and the audit's
allowlist is maintained upstream for upstream's own tree. Rename the workflows
to .disabled, as the formatter fork already does, and drop the build's
upstream-only steps.
---
 .github/workflows/build.yml                               | 8 --------
 .../{create-package.yml => create-package.yml.disabled}   | 0
 .../{create-vsix.yml => create-vsix.yml.disabled}         | 0
 ...ialize-release.yml => initialize-release.yml.disabled} | 0
 ...-artifacts.yml => make-release-artifacts.yml.disabled} | 0
 .../{publish-release.yml => publish-release.yml.disabled} | 0
 .../{security-audit.yml => security-audit.yml.disabled}   | 0
 7 files changed, 8 deletions(-)
 rename .github/workflows/{create-package.yml => create-package.yml.disabled} (100%)
 rename .github/workflows/{create-vsix.yml => create-vsix.yml.disabled} (100%)
 rename .github/workflows/{initialize-release.yml => initialize-release.yml.disabled} (100%)
 rename .github/workflows/{make-release-artifacts.yml => make-release-artifacts.yml.disabled} (100%)
 rename .github/workflows/{publish-release.yml => publish-release.yml.disabled} (100%)
 rename .github/workflows/{security-audit.yml => security-audit.yml.disabled} (100%)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5a912d629..996382210 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -21,13 +21,5 @@ jobs:
       - run: npm run build
       - run: npm run lint
       - run: npm run test
-      - name: Upload coverage to Coveralls
-        if: matrix.os == 'ubuntu-latest'
-        uses: coverallsapp/github-action@v2
-        env:
-          #hardcode the coveralls token...it's not overly important to protect, and github actions won't allow forks to work with coveralls otherwise
-          COVERALLS_REPO_TOKEN: "kVPcGJfehOArEQnHb8BT3KS72xbUQCoxI"
-        with:
-          path-to-lcov: ./coverage/lcov.info
       # this is stalling out for some reason, so disable it for now
       #- run: npm run test-related-projects
\ No newline at end of file
diff --git a/.github/workflows/create-package.yml b/.github/workflows/create-package.yml.disabled
similarity index 100%
rename from .github/workflows/create-package.yml
rename to .github/workflows/create-package.yml.disabled
diff --git a/.github/workflows/create-vsix.yml b/.github/workflows/create-vsix.yml.disabled
similarity index 100%
rename from .github/workflows/create-vsix.yml
rename to .github/workflows/create-vsix.yml.disabled
diff --git a/.github/workflows/initialize-release.yml b/.github/workflows/initialize-release.yml.disabled
similarity index 100%
rename from .github/workflows/initialize-release.yml
rename to .github/workflows/initialize-release.yml.disabled
diff --git a/.github/workflows/make-release-artifacts.yml b/.github/workflows/make-release-artifacts.yml.disabled
similarity index 100%
rename from .github/workflows/make-release-artifacts.yml
rename to .github/workflows/make-release-artifacts.yml.disabled
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml.disabled
similarity index 100%
rename from .github/workflows/publish-release.yml
rename to .github/workflows/publish-release.yml.disabled
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml.disabled
similarity index 100%
rename from .github/workflows/security-audit.yml
rename to .github/workflows/security-audit.yml.disabled