Add Windows support to Python sdk publishing

.github/workflows/ci.yml

@@ -134,12 +134,10 @@ jobs:
       - name: Python SDK Benchmark
         run: just benchmark
 
-  python-wheelhouse:
-    name: Python SDK wheelhouse test  (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest]
+  # Build all Python packages on Linux (pure + backend wheels).
+  python-wheelhouse-build-linux:
+    name: Python wheelhouse build (Linux)
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
@@ -162,14 +160,73 @@ jobs:
       - name: Install just
         run: cargo install --locked just
 
-      - name: Install clang (Linux)
-        if: runner.os == 'Linux'
+      - name: Install clang
         run: sudo apt-get update && sudo apt-get install -y clang
 
-      - name: Install LLVM (Windows)
-        if: runner.os == 'Windows'
+      - name: Build all Python packages
+        run: just python-dist
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: python-wheels-linux
+          path: dist/pythonsdk/
+
+  # Build Windows-specific maturin backend wheels only.
+  python-wheelhouse-build-windows:
+    name: Python wheelhouse build (Windows)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606  # v1.15.4
+        with:
+          cache-key: release
+          rustflags: ""
+
+      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
+
+      - name: Install Python
+        run: uv python install 3.12
+
+      - name: Install just
+        run: cargo install --locked just
+
+      - name: Install LLVM
         run: choco install llvm -y
 
+      - name: Build backend wheels
+        run: just python-dist-backends
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: python-wheels-windows
+          path: dist/pythonsdk/
+
+  # Download merged Linux + Windows wheels and run wheelhouse smoke tests.
+  python-wheelhouse-test:
+    name: Python wheelhouse test (${{ matrix.os }})
+    needs: [python-wheelhouse-build-linux, python-wheelhouse-build-windows]
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
+
+      - name: Install Python
+        run: uv python install 3.12
+
+      - name: Install just
+        run: cargo install --locked just
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist/pythonsdk/
+          merge-multiple: true
+          pattern: python-wheels-*
+
       - name: Enable KVM
         if: runner.os == 'Linux' && !env.ACT
         run: |
@@ -178,8 +235,8 @@ jobs:
           sudo udevadm trigger --name-match=kvm
           sudo chmod 666 /dev/kvm
 
-      - name: Build release wheels and run wheelhouse test
-        run: just python-wheelhouse-test
+      - name: Run wheelhouse tests
+        run: just python python-wheelhouse-test
 
   javascript-sandbox:
     name: JS Sandbox (${{ matrix.os }})

.github/workflows/publish.yml

@@ -5,16 +5,15 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: read
+
 jobs:
-  publish:
+  # Build all Python packages on Linux (pure + backend wheels).
+  build-linux:
     if: ${{ !github.event.act }}
-    name: Build & publish to PyPI
+    name: Build Linux packages
     runs-on: ubuntu-latest
-    environment:
-      name: pypi
-    permissions:
-      id-token: write
-      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
@@ -40,8 +39,70 @@ jobs:
       - name: Install clang
         run: sudo apt-get update && sudo apt-get install -y clang
 
-      - name: Build & Publish
-        if: ${{ !env.ACT }}
-        run: |
-          just python-dist
-          just python python-publish
+      - name: Build all Python packages
+        run: just python-dist
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: python-wheels-linux
+          path: dist/pythonsdk/
+
+  # Build Windows-specific maturin backend wheels only.
+  build-windows:
+    if: ${{ !github.event.act }}
+    name: Build Windows backend wheels
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606  # v1.15.4
+        with:
+          cache-key: release
+          rustflags: ""
+
+      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
+
+      - name: Install Python
+        run: uv python install 3.12
+
+      - name: Install just
+        run: cargo install --locked just
+
+      - name: Install LLVM
+        run: choco install llvm -y
+
+      - name: Build backend wheels
+        run: just python-dist-backends
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: python-wheels-windows
+          path: dist/pythonsdk/
+
+  # Merge artifacts from both platforms and publish to PyPI.
+  publish:
+    if: ${{ !github.event.act }}
+    name: Publish to PyPI
+    needs: [build-linux, build-windows]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
+
+      - name: Install just
+        run: cargo install --locked just
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist/pythonsdk/
+          merge-multiple: true
+          pattern: python-wheels-*
+
+      - name: Publish to PyPI
+        run: just python python-publish

Justfile

@@ -43,6 +43,11 @@ benchmark: python::python-sandbox-benchmark
 
 python-dist: (wasm::build "release") (js::build "release") python::python-dist
 
+python-dist-backends: wasm::_clean-stale-wasm wasm::guest-compile-wit js::_clean-stale
+    cargo build --manifest-path src/wasm_sandbox/Cargo.toml --release
+    cargo build --manifest-path src/javascript_sandbox/Cargo.toml --release
+    just python python-dist-backends
+
 python-wheelhouse-test: python-dist python::python-wheelhouse-test
 
 examples target=default-target: (wasm::examples target) (js::examples target) python::examples

src/sdk/python/Justfile

@@ -58,6 +58,15 @@ python-dist: python-sync-guest-resources
     cd {{repo-root}}/src/sdk/python/wasm_guests/python_guest && uv run python -m build --outdir {{python-guest-dist}}
     cd {{repo-root}}/src/sdk/python/wasm_guests/javascript_guest && uv run python -m build --outdir {{javascript-guest-dist}}
 
+# Build only the platform-specific maturin backend wheels.
+# Used by CI to produce Windows wheels without needing guest binaries.
+# Requires sandbox-world.wasm to exist (run `just wasm guest-compile-wit` first).
+python-dist-backends: python-sync-env
+    -{{rmrf}} {{wasm-wheels}}
+    -{{rmrf}} {{hyperlight-js-wheels}}
+    cd {{repo-root}}/src/sdk/python/wasm_backend && uv run maturin build --release --out {{wasm-wheels}}
+    cd {{repo-root}}/src/sdk/python/hyperlight_js_backend && uv run maturin build --release --out {{hyperlight-js-wheels}}
+
 python-publish repository="pypi":
     uv publish {{ if repository != "pypi" { "--publish-url https://test.pypi.org/legacy/" } else { "" } }} {{wasm-wheels}}/*
     uv publish {{ if repository != "pypi" { "--publish-url https://test.pypi.org/legacy/" } else { "" } }} {{hyperlight-js-wheels}}/*
@@ -74,7 +83,13 @@ python-wheelhouse-test:
         --find-links={{wasm-wheels}} \
         --find-links={{python-guest-dist}} \
         --with "hyperlight-sandbox[wasm,python_guest]" \
-        python {{repo-root}}/src/sdk/python/tests/wheelhouse_wasm.py
+        python {{repo-root}}/src/sdk/python/tests/wheelhouse_wasm_python.py
+    uv run --no-project --no-index \
+        --find-links={{core-dist}} \
+        --find-links={{wasm-wheels}} \
+        --find-links={{javascript-guest-dist}} \
+        --with "hyperlight-sandbox[wasm,javascript_guest]" \
+        python {{repo-root}}/src/sdk/python/tests/wheelhouse_wasm_js.py
     uv run --no-project --no-index \
         --find-links={{core-dist}} \
         --find-links={{hyperlight-js-wheels}} \

src/sdk/python/core/pyproject.toml

@@ -17,6 +17,7 @@ classifiers = [
     "Programming Language :: Python :: 3",
     "Programming Language :: Rust",
     "Operating System :: POSIX :: Linux",
+    "Operating System :: Microsoft :: Windows",
 ]
 keywords = ["hyperlight", "wasm", "sandbox", "isolation", "code-execution"]
 

src/sdk/python/hyperlight_js_backend/pyproject.toml

@@ -15,6 +15,7 @@ classifiers = [
     "Programming Language :: Python :: 3",
     "Programming Language :: Rust",
     "Operating System :: POSIX :: Linux",
+    "Operating System :: Microsoft :: Windows",
 ]
 
 [tool.maturin]

src/sdk/python/tests/wheelhouse_js.py

@@ -1,6 +1,6 @@
 from hyperlight_sandbox import Sandbox
 
 sandbox = Sandbox(backend="hyperlight-js")
-result = sandbox.run('console.log("wheelhouse install ok")')
+result = sandbox.run('console.log("wheelhouse hyperlight-js install ok")')
 assert result.success, result.stderr
 print(result.stdout.strip())

src/sdk/python/tests/wheelhouse_wasm_js.py

@@ -0,0 +1,6 @@
+from hyperlight_sandbox import Sandbox
+
+sandbox = Sandbox(backend="wasm", module="javascript_guest.path")
+result = sandbox.run('console.log("wheelhouse wasm javascript install ok")')
+assert result.success, result.stderr
+print(result.stdout.strip())

src/sdk/python/tests/wheelhouse_wasm_python.py

@@ -0,0 +1,6 @@
+from hyperlight_sandbox import Sandbox
+
+sandbox = Sandbox(backend="wasm", module="python_guest.path")
+result = sandbox.run('print("wheelhouse wasm python install ok")')
+assert result.success, result.stderr
+print(result.stdout.strip())

src/sdk/python/wasm_backend/pyproject.toml

@@ -15,6 +15,7 @@ classifiers = [
     "Programming Language :: Python :: 3",
     "Programming Language :: Rust",
     "Operating System :: POSIX :: Linux",
+    "Operating System :: Microsoft :: Windows",
 ]
 
 [tool.maturin]