From 66cf3714dd3bed32e7169c12a653c285ebd687b4 Mon Sep 17 00:00:00 2001 From: James Sturtevant Date: Fri, 4 Sep 2026 17:08:18 -0700 Subject: [PATCH 1/2] Publish Rust crates during releases Signed-off-by: James Sturtevant --- .github/workflows/publish.yml | 26 ++++++++++++++++++- Cargo.toml | 9 ++++--- RELEASE.md | 6 ++++- src/hyperlight_sandbox/Cargo.toml | 3 +++ src/javascript_sandbox/Cargo.toml | 3 +++ src/sdk/dotnet/ffi/Cargo.toml | 1 + .../python/hyperlight_js_backend/Cargo.toml | 1 + src/sdk/python/pyo3_common/Cargo.toml | 1 + src/sdk/python/wasm_backend/Cargo.toml | 1 + src/wasm_sandbox/Cargo.toml | 3 +++ src/wasm_sandbox/src/lib.rs | 2 +- 11 files changed, 50 insertions(+), 6 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 3544233..84064cc 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,4 +1,4 @@ -name: Publish Python SDK & .NET SDK +name: Publish Rust crates, Python SDK & .NET SDK on: push: @@ -12,6 +12,7 @@ on: type: choice options: - all + - rust - python - dotnet default: all @@ -20,6 +21,29 @@ permissions: contents: read jobs: + # Publish public Rust crates in workspace dependency order. + rust-publish: + if: ${{ !github.event.act && (github.event_name != 'workflow_dispatch' || inputs.publish_target == 'all' || inputs.publish_target == 'rust') }} + name: Publish Rust crates + runs-on: ubuntu-latest + environment: + name: crates-io + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 + with: + cache-key: release + rustflags: "" + + - name: Publish to crates.io + env: + CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} + run: | + cargo publish --locked -p hyperlight-sandbox + cargo publish --locked -p hyperlight-wasm-sandbox + cargo publish --locked -p hyperlight-javascript-sandbox + # Build all Python packages on Linux for glibc 2.28 and newer. build-linux: if: ${{ !github.event.act && (github.event_name != 'workflow_dispatch' || inputs.publish_target == 'all' || inputs.publish_target == 'python') }} diff --git a/Cargo.toml b/Cargo.toml index e28aa04..998762f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -15,11 +15,14 @@ version = "0.6.0" edition = "2024" rust-version = "1.94" license = "Apache-2.0" +repository = "https://github.com/hyperlight-dev/hyperlight-sandbox" +keywords = ["hyperlight", "isolation", "sandbox", "wasm"] +categories = ["virtualization"] [workspace.dependencies] -hyperlight-sandbox = { path = "src/hyperlight_sandbox" } -hyperlight-javascript-sandbox = { path = "src/javascript_sandbox" } -hyperlight-wasm-sandbox = { path = "src/wasm_sandbox" } +hyperlight-sandbox = { version = "0.6.0", path = "src/hyperlight_sandbox" } +hyperlight-javascript-sandbox = { version = "0.6.0", path = "src/javascript_sandbox" } +hyperlight-wasm-sandbox = { version = "0.6.0", path = "src/wasm_sandbox" } hyperlight-sandbox-pyo3-common = { path = "src/sdk/python/pyo3_common" } hyperlight-common = { version = "0.17.0", default-features = false } hyperlight-component-macro = "0.17.0" diff --git a/RELEASE.md b/RELEASE.md index 9baa245..fa39881 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -6,7 +6,8 @@ Bump the version in **all** manifest files. For example, to go from `0.1.0` → ### Rust (Cargo) -- `Cargo.toml` — `[workspace.package] version` +- `Cargo.toml` — `[workspace.package] version` and the versions for local crates in + `[workspace.dependencies]` All other workspace member crates inherit the version automatically. @@ -48,3 +49,6 @@ git push --tags ``` Replace `v0.2.0` with the version you are releasing. + +The publish workflow releases the public Rust crates to crates.io in dependency order, +followed independently by the Python and .NET packages. diff --git a/src/hyperlight_sandbox/Cargo.toml b/src/hyperlight_sandbox/Cargo.toml index 71882e6..7d2d61a 100644 --- a/src/hyperlight_sandbox/Cargo.toml +++ b/src/hyperlight_sandbox/Cargo.toml @@ -4,6 +4,9 @@ version.workspace = true edition.workspace = true rust-version.workspace = true license.workspace = true +repository.workspace = true +keywords.workspace = true +categories.workspace = true description = "High-level Rust host library for running sandbox guests across multiple backends." [dependencies] diff --git a/src/javascript_sandbox/Cargo.toml b/src/javascript_sandbox/Cargo.toml index af187f7..01c4f9c 100644 --- a/src/javascript_sandbox/Cargo.toml +++ b/src/javascript_sandbox/Cargo.toml @@ -4,6 +4,9 @@ version.workspace = true edition.workspace = true rust-version.workspace = true license.workspace = true +repository.workspace = true +keywords.workspace = true +categories.workspace = true description = "Hyperlight JS guest for hyperlight-sandbox" [dependencies] diff --git a/src/sdk/dotnet/ffi/Cargo.toml b/src/sdk/dotnet/ffi/Cargo.toml index b529650..b0cbe8c 100644 --- a/src/sdk/dotnet/ffi/Cargo.toml +++ b/src/sdk/dotnet/ffi/Cargo.toml @@ -5,6 +5,7 @@ edition.workspace = true rust-version.workspace = true license.workspace = true description = "C-compatible FFI layer for the hyperlight-sandbox .NET SDK" +publish = false [lib] # cdylib for the .NET P/Invoke shared library. diff --git a/src/sdk/python/hyperlight_js_backend/Cargo.toml b/src/sdk/python/hyperlight_js_backend/Cargo.toml index 00cfa6c..f236d02 100644 --- a/src/sdk/python/hyperlight_js_backend/Cargo.toml +++ b/src/sdk/python/hyperlight_js_backend/Cargo.toml @@ -5,6 +5,7 @@ edition.workspace = true rust-version.workspace = true license.workspace = true description = "HyperlightJS backend bindings for hyperlight-sandbox" +publish = false [lib] name = "_native_js" diff --git a/src/sdk/python/pyo3_common/Cargo.toml b/src/sdk/python/pyo3_common/Cargo.toml index 4ca3e1a..5d33877 100644 --- a/src/sdk/python/pyo3_common/Cargo.toml +++ b/src/sdk/python/pyo3_common/Cargo.toml @@ -5,6 +5,7 @@ edition.workspace = true rust-version.workspace = true license.workspace = true description = "Shared PyO3 helpers for hyperlight-sandbox backend crates" +publish = false [dependencies] pyo3.workspace = true diff --git a/src/sdk/python/wasm_backend/Cargo.toml b/src/sdk/python/wasm_backend/Cargo.toml index 62a2912..0820fa8 100644 --- a/src/sdk/python/wasm_backend/Cargo.toml +++ b/src/sdk/python/wasm_backend/Cargo.toml @@ -5,6 +5,7 @@ edition.workspace = true rust-version.workspace = true license.workspace = true description = "Wasm backend bindings for hyperlight-sandbox" +publish = false [lib] name = "_native_wasm" diff --git a/src/wasm_sandbox/Cargo.toml b/src/wasm_sandbox/Cargo.toml index b815141..7e21af8 100644 --- a/src/wasm_sandbox/Cargo.toml +++ b/src/wasm_sandbox/Cargo.toml @@ -4,6 +4,9 @@ version.workspace = true edition.workspace = true rust-version.workspace = true license.workspace = true +repository.workspace = true +keywords.workspace = true +categories.workspace = true description = "Wasm component sandbox backend for hyperlight-sandbox (Python, JavaScript, etc.)" [dependencies] diff --git a/src/wasm_sandbox/src/lib.rs b/src/wasm_sandbox/src/lib.rs index 32ce644..a639389 100644 --- a/src/wasm_sandbox/src/lib.rs +++ b/src/wasm_sandbox/src/lib.rs @@ -19,7 +19,7 @@ mod wasi_impl; type HostBindings = hyperlight_common::component::Negative; pub(crate) mod bindings { - hyperlight_component_macro::host_bindgen!("wit/sandbox-world.wasm"); + hyperlight_component_macro::host_bindgen!(wit: "wit/hyperlight-sandbox.wit"); } #[derive(Debug, Clone, Copy, Default)] From ffb7a70c38420978193cc884facdc8bfec6e8a08 Mon Sep 17 00:00:00 2001 From: James Sturtevant Date: Tue, 8 Sep 2026 14:56:53 -0700 Subject: [PATCH 2/2] Use trusted publishing for crates.io Signed-off-by: James Sturtevant --- .github/workflows/publish.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 84064cc..0465e4c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -28,6 +28,9 @@ jobs: runs-on: ubuntu-latest environment: name: crates-io + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -36,9 +39,13 @@ jobs: cache-key: release rustflags: "" + - name: Authenticate with crates.io + uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5 + id: crates-io-auth + - name: Publish to crates.io env: - CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} + CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }} run: | cargo publish --locked -p hyperlight-sandbox cargo publish --locked -p hyperlight-wasm-sandbox