Run 5196 (2026-05-11 02:46Z, first-ever successful publish) succeeded
the publish job but failed the cascade job at the wait-for-PyPI-
propagation step:
::error::PyPI propagated 0.1.130 but wheel content SHA256 mismatch.
::error::Expected: 536b123816f3c7fb54690b80be482b28cabd1874690e9e93d8586af3864c7fba
::error::Got: Collecting molecule-ai-workspace-runtime==0.1.130
::error::Fastly may be serving stale content. Refusing to fan out cascade.
The 'Got:' is pip's own stdout, not a SHA. Root cause:
HASH=$(python -m pip download ... 2>/dev/null && sha256sum ... | awk ...)
The shell pipeline captures BOTH commands' stdout into $HASH. `2>/dev/null`
only silences stderr, not stdout. pip download writes 'Collecting ...' to
stdout by default, so it leaks into HASH ahead of sha256sum's output.
Fix: split into two steps, redirect pip stdout to /dev/null explicitly,
capture only sha256sum's output into HASH.
Impact: cascade-to-8-template-repos failed, but PyPI publish itself
succeeded. Users (workspace-template-* maintainers) can pin manually
via 'docker build --build-arg RUNTIME_VERSION=X.Y.Z' until cascade is
healed. hongming-pc is doing exactly this for the plugins_registry rollout.
4th and likely last workflow defect after #353, #355, #357.
Refs: #351, #353, #355, #357, #348 Q3
