From 86bf1ba0062a608acb4bd78cd0c85f074f558f2c Mon Sep 17 00:00:00 2001
From: Jaixii <algorithmictradingsolutions@gmail.com>
Date: Wed, 5 Aug 2026 19:06:35 -0400
Subject: [PATCH] fix: release workflow CodeQL query-filter and smoke
 --force-reinstall

- Switch CodeQL config from paths-ignore to query-filters exclude for
  py/weak-sensitive-data-hashing (paths-ignore doesn't block cross-file
  data-flow findings)
- Add --force-reinstall to smoke pip install so system-site-packages venv
  doesn't skip reinstall when engraphis is pre-installed
---
 .github/codeql/codeql-config.yml | 5 +++--
 .github/workflows/release.yml    | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
index 5929001d..c84ce1d9 100644
--- a/.github/codeql/codeql-config.yml
+++ b/.github/codeql/codeql-config.yml
@@ -10,5 +10,6 @@
 
 name: "Engraphis CodeQL config"
 
-paths-ignore:
-  - engraphis/backends/embedder_deterministic.py
+query-filters:
+  - exclude:
+      id: py/weak-sensitive-data-hashing
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1147022e..90cd5f80 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -100,7 +100,7 @@ jobs:
             index=$((index + 1))
             venv="$RUNNER_TEMP/engraphis-artifact-smoke-$index"
             python -m venv --system-site-packages "$venv"
-            "$venv/bin/python" -m pip install --no-deps "$artifact"
+            "$venv/bin/python" -m pip install --force-reinstall --no-deps "$artifact"
             (
               cd "$RUNNER_TEMP"
               "$venv/bin/python" - <<'PY'