Keep runtime builder path stable [skip ci]

2026-08-04 16:34:07 +02:00
parent 8aba74e01e
commit 8262215fcd
3 changed files with 4 additions and 1 deletions
@@ -153,6 +153,8 @@ being selected from an undeclared registry.
 The runtime distribution workflow uses the verified wheelhouse directly and
 installs module WebUI tarballs only after matching them to the lock. It publishes
 the package set, package lock, and hash-locked requirements as release assets.
+The WebUI installer receives the absolute runtime-build interpreter path so its
+directory changes cannot escape the isolated release environment.
 The package-lock SHA-256 is part of the signed distribution manifest. Runtime
 finalization also requires the lock's package versions and hashes to match the
 wheel composition embedded in the images. OCI assembly remains network-free