Publish Rust crates during releases

.github/workflows/publish.yml

@@ -1,4 +1,4 @@
-name: Publish Python SDK & .NET SDK
+name: Publish Rust crates, Python SDK & .NET SDK
 
 on:
   push:
@@ -12,6 +12,7 @@ on:
         type: choice
         options:
           - all
+          - rust
           - python
           - dotnet
         default: all
@@ -20,6 +21,36 @@ permissions:
   contents: read
 
 jobs:
+  # Publish public Rust crates in workspace dependency order.
+  rust-publish:
+    if: ${{ !github.event.act && (github.event_name != 'workflow_dispatch' || inputs.publish_target == 'all' || inputs.publish_target == 'rust') }}
+    name: Publish Rust crates
+    runs-on: ubuntu-latest
+    environment:
+      name: crates-io
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        with:
+          cache-key: release
+          rustflags: ""
+
+      - name: Authenticate with crates.io
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18  # v1.0.5
+        id: crates-io-auth
+
+      - name: Publish to crates.io
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
+        run: |
+          cargo publish --locked -p hyperlight-sandbox
+          cargo publish --locked -p hyperlight-wasm-sandbox
+          cargo publish --locked -p hyperlight-javascript-sandbox
+
   # Build all Python packages on Linux for glibc 2.28 and newer.
   build-linux:
     if: ${{ !github.event.act && (github.event_name != 'workflow_dispatch' || inputs.publish_target == 'all' || inputs.publish_target == 'python') }}

Cargo.toml

@@ -15,11 +15,14 @@ version = "0.6.0"
 edition = "2024"
 rust-version = "1.94"
 license = "Apache-2.0"
+repository = "https://github.com/hyperlight-dev/hyperlight-sandbox"
+keywords = ["hyperlight", "isolation", "sandbox", "wasm"]
+categories = ["virtualization"]
 
 [workspace.dependencies]
-hyperlight-sandbox = { path = "src/hyperlight_sandbox" }
-hyperlight-javascript-sandbox = { path = "src/javascript_sandbox" }
-hyperlight-wasm-sandbox = { path = "src/wasm_sandbox" }
+hyperlight-sandbox = { version = "0.6.0", path = "src/hyperlight_sandbox" }
+hyperlight-javascript-sandbox = { version = "0.6.0", path = "src/javascript_sandbox" }
+hyperlight-wasm-sandbox = { version = "0.6.0", path = "src/wasm_sandbox" }
 hyperlight-sandbox-pyo3-common = { path = "src/sdk/python/pyo3_common" }
 hyperlight-common = { version = "0.17.0", default-features = false }
 hyperlight-component-macro = "0.17.0"

RELEASE.md

@@ -6,7 +6,8 @@ Bump the version in **all** manifest files. For example, to go from `0.1.0` →
 
 ### Rust (Cargo)
 
-- `Cargo.toml` — `[workspace.package] version`
+- `Cargo.toml` — `[workspace.package] version` and the versions for local crates in
+  `[workspace.dependencies]`
 
 All other workspace member crates inherit the version automatically.
 
@@ -48,3 +49,6 @@ git push --tags
 ```
 
 Replace `v0.2.0` with the version you are releasing.
+
+The publish workflow releases the public Rust crates to crates.io in dependency order,
+followed independently by the Python and .NET packages.

src/hyperlight_sandbox/Cargo.toml

@@ -4,6 +4,9 @@ version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
+repository.workspace = true
+keywords.workspace = true
+categories.workspace = true
 description = "High-level Rust host library for running sandbox guests across multiple backends."
 
 [dependencies]

src/javascript_sandbox/Cargo.toml

@@ -4,6 +4,9 @@ version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
+repository.workspace = true
+keywords.workspace = true
+categories.workspace = true
 description = "Hyperlight JS guest for hyperlight-sandbox"
 
 [dependencies]

src/sdk/dotnet/ffi/Cargo.toml

@@ -5,6 +5,7 @@ edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
 description = "C-compatible FFI layer for the hyperlight-sandbox .NET SDK"
+publish = false
 
 [lib]
 # cdylib for the .NET P/Invoke shared library.

src/sdk/python/hyperlight_js_backend/Cargo.toml

@@ -5,6 +5,7 @@ edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
 description = "HyperlightJS backend bindings for hyperlight-sandbox"
+publish = false
 
 [lib]
 name = "_native_js"

src/sdk/python/pyo3_common/Cargo.toml

@@ -5,6 +5,7 @@ edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
 description = "Shared PyO3 helpers for hyperlight-sandbox backend crates"
+publish = false
 
 [dependencies]
 pyo3.workspace = true

src/sdk/python/wasm_backend/Cargo.toml

@@ -5,6 +5,7 @@ edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
 description = "Wasm backend bindings for hyperlight-sandbox"
+publish = false
 
 [lib]
 name = "_native_wasm"

src/wasm_sandbox/Cargo.toml

@@ -4,6 +4,9 @@ version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
+repository.workspace = true
+keywords.workspace = true
+categories.workspace = true
 description = "Wasm component sandbox backend for hyperlight-sandbox (Python, JavaScript, etc.)"
 
 [dependencies]

src/wasm_sandbox/src/lib.rs

@@ -19,7 +19,7 @@ mod wasi_impl;
 type HostBindings = hyperlight_common::component::Negative;
 
 pub(crate) mod bindings {
-    hyperlight_component_macro::host_bindgen!("wit/sandbox-world.wasm");
+    hyperlight_component_macro::host_bindgen!(wit: "wit/hyperlight-sandbox.wit");
 }
 
 #[derive(Debug, Clone, Copy, Default)]