Add a specific job just for publishing tests

.github/workflows/ci.yml

@@ -123,11 +123,44 @@ jobs:
       - name: Python SDK Benchmark
         run: just benchmark
 
-      # Build release wheels and verify they install + work correctly
-      - name: Python SDK Wheelhouse test
+  python-wheelhouse:
+    name: Python SDK · wheelhouse test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606  # v1.15.4
+        with:
+          cache-key: release
+          rustflags: ""
+
+      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
+
+      - name: Install Python
+        run: uv python install 3.12
+
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
+        with:
+          node-version: "latest"
+          cache: npm
+          cache-dependency-path: src/wasm_sandbox/guests/javascript/package-lock.json
+
+      - name: Install just
+        run: cargo install --locked just
+
+      - name: Install clang
+        run: sudo apt-get update && sudo apt-get install -y clang
+
+      - name: Enable KVM
+        if: ${{ !env.ACT }}
         run: |
-          just python-dist
-          just python python-wheelhouse-test
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+          sudo chmod 666 /dev/kvm
+
+      - name: Build release wheels and run wheelhouse test
+        run: just python-wheelhouse-test
 
   javascript-sandbox:
     name: JS Sandbox · lint / build / examples

.github/workflows/publish.yml

@@ -40,9 +40,6 @@ jobs:
       - name: Install clang
         run: sudo apt-get update && sudo apt-get install -y clang
 
-      - name: Install JS guest dependencies
-        run: just wasm js-guest-install
-
       - name: Build & Publish
         if: ${{ !env.ACT }}
         run: |

Justfile

@@ -41,7 +41,9 @@ test-rust:
 
 benchmark: python::python-sandbox-benchmark
 
-python-dist: (wasm::build "release") python::python-dist
+python-dist: (wasm::build "release") (jssandbox::build "release") python::python-dist
+
+python-wheelhouse-test: python-dist python::python-wheelhouse-test
 
 examples target=default-target: (wasm::examples target) (jssandbox::examples target) python::examples
 

src/javascript_sandbox/Justfile

@@ -7,13 +7,15 @@ build target=default-target:
     # If cargo fingerprints exist but the runtime binary is missing, clean stale state
     # to force hyperlight-js's build script to re-run. This can happen when rust-cache
     # restores partial artifacts.
-    if compgen -G "{{repo-root}}/target/debug/build/hyperlight-js-*" > /dev/null && \
-       [ ! -f "{{repo-root}}/target/hyperlight-js-runtime/x86_64-hyperlight-none/debug/hyperlight-js-runtime" ]; then
-        echo "Cleaning stale hyperlight-js build artifacts..."
-        rm -rf {{repo-root}}/target/hyperlight-js-runtime \
-               {{repo-root}}/target/debug/build/hyperlight-js-* \
-               {{repo-root}}/target/debug/.fingerprint/hyperlight-js-*
-    fi
+    for profile in debug release; do
+        if compgen -G "{{repo-root}}/target/$profile/build/hyperlight-js-*" > /dev/null && \
+           [ ! -f "{{repo-root}}/target/hyperlight-js-runtime/x86_64-hyperlight-none/$profile/hyperlight-js-runtime" ]; then
+            echo "Cleaning stale hyperlight-js $profile build artifacts..."
+            rm -rf {{repo-root}}/target/hyperlight-js-runtime \
+                   {{repo-root}}/target/$profile/build/hyperlight-js-* \
+                   {{repo-root}}/target/$profile/.fingerprint/hyperlight-js-*
+        fi
+    done
     {{ wit-world }} cargo build --manifest-path {{repo-root}}/src/javascript_sandbox/Cargo.toml --profile={{ if target == "debug" {"dev"} else { target } }}
 
 #### EXAMPLES ####

src/sdk/python/Justfile

@@ -73,7 +73,10 @@ python-publish repository="pypi":
     uv publish "${publish_url[@]}" {{javascript-guest-dist}}/*
     uv publish "${publish_url[@]}" {{core-dist}}/*
 
-python-wheelhouse-test: python-dist
+# Smoke-test the wheels in dist/pythonsdk/ by installing them into
+# isolated environments and running basic tests.
+# Requires `just python-dist` (root) to have been run first.
+python-wheelhouse-test:
     #!/usr/bin/env bash
     set -e
     root={{repo-root}}

src/wasm_sandbox/Justfile

@@ -22,10 +22,15 @@ guest-compile-wit: ensure-tools
     @# Without this, cargo won't detect that sandbox-world.wasm changed
     @# and SDKs will fail at runtime with "vector parameter missing length".
     rm -rf {{repo-root}}/target/hyperlight-wasm-runtime \
+           {{repo-root}}/target/hyperlight-js-runtime \
            {{repo-root}}/target/debug/build/hyperlight-wasm-* \
            {{repo-root}}/target/debug/.fingerprint/hyperlight-wasm-* \
            {{repo-root}}/target/release/build/hyperlight-wasm-* \
            {{repo-root}}/target/release/.fingerprint/hyperlight-wasm-* \
+           {{repo-root}}/target/debug/build/hyperlight-js-* \
+           {{repo-root}}/target/debug/.fingerprint/hyperlight-js-* \
+           {{repo-root}}/target/release/build/hyperlight-js-* \
+           {{repo-root}}/target/release/.fingerprint/hyperlight-js-* \
            {{repo-root}}/src/sdk/python/wasm_backend/target/hyperlight-wasm-runtime \
            {{repo-root}}/src/sdk/python/wasm_backend/target/debug/build/hyperlight-wasm-* \
            {{repo-root}}/src/sdk/python/wasm_backend/target/debug/.fingerprint/hyperlight-wasm-* \