release-skill 0.7.6 → 0.7.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/platform-manifest.json

@@ -2,11 +2,11 @@
   "schemaVersion": "1.0.0",
   "platformId": "release-skill",
   "platformName": "release-skill Plugin Platform",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "logicalRoot": "skills-src/",
-  "logicalRootDigest": "7889a5f745d1f51ede024d4df68853128f2440a05f430da77a25b78c7c3d396f",
-  "projectionDigest": "9709f8e22722faaca894d067dce7a9534813a6abf241f00e796a5a47b5f69f72",
-  "projectionId": "release-skill:platform:0.7.6",
+  "logicalRootDigest": "b261a4cc49e6dc52dabddb083c22e414902fb269d5879ad01ef8146ceffd7bc7",
+  "projectionDigest": "6629de035a25005fd4676b09a0526a46f992a33d974cadd542b0c964d7f906ff",
+  "projectionId": "release-skill:platform:0.7.8",
   "manifestRequired": true,
   "projectionSources": {
     "skills-src-root": {

package/references/.render-manifest.json

@@ -6,12 +6,12 @@
       "bytes": 6335
     },
     "01-state-machine.md": {
-      "digest": "711265e093be13f582ac8be89c391eff79ac22f56c25b91d1ccaef31856ef269",
-      "bytes": 12086
+      "digest": "5afc8e9c29c0d5fb0de0db8b248bbb812fc715af185ac594a172fe68d9a24fed",
+      "bytes": 12617
     },
     "02-project-config.md": {
-      "digest": "ce1986761f2aee9aab2646170cbd9ee3d14b7032db3bfb57b17e7369a45197f2",
-      "bytes": 21924
+      "digest": "09e3c470dea54fe9437528620cc169596e75b5162e137683923347c9cb3702a6",
+      "bytes": 23167
     },
     "03-readme-quality.md": {
       "digest": "d74e41052592443ebbd450d0ace5f9b9b19c7a94db50f952b17c1c5a4c5dc230",
@@ -26,8 +26,8 @@
       "bytes": 12014
     },
     "06-adapter-contract.md": {
-      "digest": "e00c175b24764487618dfdf20dc295f12a7e809f7dbfc69f6936a1e97bd02ab8",
-      "bytes": 18517
+      "digest": "fd58e8a438aaa9a7a4a939ac190dbdd5d11c3fcaca08feaced4a612a6d6dcf3f",
+      "bytes": 19206
     }
   }
 }

package/references/01-state-machine.md

@@ -148,7 +148,7 @@ postPublish hooks 分两个阶段，各自对应独立的 distribute run：
 
 工作区基线（Git tree hash、workspace digest、捕获时间）与生命周期状态（计划 status、createdAt、action 运行时 status）是**记录层审计数据**：继续写入计划与审批文件以备查，但不参与 planVersion 2 的 digest、不使批准失效。publish/reconcile 检测到基线漂移时记录 warning 级证据事件并继续执行，产物完整性由发布前的冻结产物重验兜底。planVersion 1（旧版）计划维持旧规则：Git tree hash 与 workspace digest 变化同样使批准失效，基线漂移硬失败（BASELINE_CHANGED）。
 
-远端冲突状态（如 tag 已存在、npm 版本冲突等）不在 approval 绑定字段中；它在 publish/reconcile 的 preflight 阶段阻断执行并要求人工决策。
+远端冲突状态不在 approval 绑定字段中。远端对象已存在但与冻结计划完全一致时，`publish`/`reconcile` 把对应检查点标为 `SKIPPED`；存在且不一致，或无法可靠判断时，preflight 阶段阻断执行并要求人工决策。npm 版本只有在观察到有效且与冻结计划相同的 integrity 时才能进入 `SKIPPED`；integrity 缺失、空白、无法解析或不同都在任何 Adapter execute 前失败关闭。
 
 失效后系统回退到 PREPARED 状态，要求重新批准。
 
@@ -161,7 +161,7 @@ postPublish hooks 分两个阶段，各自对应独立的 distribute run：
 3. 创建并推送签名或可追溯 tag。
 4. 发布 npm 包。
 5. 创建 GitHub Release。
-6. 写入远端 URL、commit、tag、包版本、integrity 和执行结果。
+6. 写入远端 URL、commit、tag、包版本、integrity 和执行结果。若 npm 检查点因执行前观察结果为 `CONSISTENT` 而跳过，只把本次观察到的 integrity 保存到检查点的 `remoteRef.integrity`；包名、版本、registry、预期 integrity 和 tarball 摘要继续以冻结计划为准。
 
 任一步失败都停止后续动作，保存检查点并进入 PARTIAL。已完成的检查点通过 `observe` 验证后在 `reconcile` 中幂等跳过。
 

package/references/02-project-config.md

@@ -27,6 +27,10 @@ project:
   defaultBranch: <string>        # workspace 远端默认分支，必填；不限定为 main
   sourceRepository: <owner/repo> # workspace 源仓库；生产发布必填
 
+publicSourceAuthorityReceipt:    # 可选；把源码坐标与多个 npm tarball 绑定为公开 Release asset
+  coordinatorUnitId: <release-unit-id>
+  subjectUnitIds: [<release-unit-id>]
+
 releaseUnits:               # 发布单元数组，至少 1 个
   - id: <string>            # 唯一标识
     source: <string>        # 源码相对路径（相对项目根目录）
@@ -108,6 +112,20 @@ policy:                     # 可选，安全策略
   forbiddenContentPatterns: [<string>]
 ```
 
+`publicSourceAuthorityReceipt` 只适用于 production prepare。`coordinatorUnitId`
+指定承载该文件的 GitHub Release；`subjectUnitIds` 必须引用现有 release unit，且每个
+unit 恰好声明一个 npm distribution。prepare 等所有 subject tarball 冻结后生成
+`source-authority-receipt.json`，其公开结构固定为：
+
+```json
+{"schemaVersion":1,"kind":"skill-family.source-authority-receipt","sourceRepository":"owner/workspace","sourceBaseCommit":"<full-commit>","subjects":[{"packageName":"@scope/package","version":"1.2.3","filename":"scope-package-1.2.3.tgz","sha256":"<sha256>"}]}
+```
+
+该文件使用 canonical JSON，不带自摘要，也不包含 release-skill 的计划、运行或批准字段。
+冻结计划记录文件 SHA-256；publish 将相同字节上传到 coordinator GitHub Release，verify
+重新下载远端字节并核对 SHA-256。离线消费者只需该文件和其中 subjects 对应的精确 tarball，便可
+核对包名、版本、文件名、tarball SHA-256、源码仓库与源码基线提交。
+
 `postPublish` 只能位于某个 `releaseUnits[]` 条目内。下面的完整结构样例会由 schema 契约测试直接读取并校验，避免文档层级再次漂移：
 
 ```yaml

package/references/06-adapter-contract.md

@@ -205,6 +205,7 @@ marketplace install action 的安装侧载荷校验以 action 参数 `payloadCon
 
 ### 4.1 幂等规则
 
+- `publish` 在全局 preflight 发现远端对象已存在时，先用同一套 `observe` 分类判断它是已一致还是冲突；已一致的检查点进入 `SKIPPED`，冲突或无法可靠判断时在任何 execute 前失败关闭。
 - `reconcile` 阶段首先通过 `observe` 查询所有计划操作的远端状态。
 - 状态为 `CONSISTENT` 的操作幂等跳过，不重新执行。
 - 状态为 `MISSING` 的操作安全重试。
@@ -226,7 +227,7 @@ marketplace install action 的安装侧载荷校验以 action 参数 `payloadCon
 - 执行前的 `observe` 结果。
 - 执行结果（成功/失败/跳过）。
 - 执行后的 `observe` 验证结果。
-- 远端资源标识（commit、tag、版本、URL）。
+- 远端资源标识（commit、tag、版本、URL）。npm 检查点因 `preObserve=CONSISTENT` 而跳过时，可在 `remoteRef.integrity` 保存本次观察到的有效 integrity；其他 npm 身份和摘要继续由冻结计划提供。
 
 ---
 
@@ -238,9 +239,9 @@ marketplace install action 的安装侧载荷校验以 action 参数 `payloadCon
 2. 重新验证发布计划摘要。
 3. 检查批准记录是否过期。
 4. 按 planVersion 分叉复验工作区基线：planVersion 1 计划基线变化即失败（`BASELINE_CHANGED`）；planVersion 2 计划基线漂移仅记录 warning 级证据事件并继续，产物身份由外部写之前的冻结产物复验保证。
-5. 执行远程 preflight。
+5. 执行全局远程 preflight；占用类结果先用只读 pre-observe 仲裁，`CONSISTENT` 放行到幂等跳过路径，`CONFLICTING` 或不可可靠观察时失败关闭。
 6. 按批准的操作列表顺序执行每个检查点。
-7. 每个检查点：preflight -> execute -> observe -> 记录。
+7. 每个检查点：pre-observe -> preflight -> execute -> post-observe -> 记录。pre-observe 为 `CONSISTENT` 时直接记录 `SKIPPED`，不调用 execute 或 post-observe。
 8. 任一检查点失败时停止后续动作，计算 PARTIAL（若已有成功检查点）。
 9. 所有检查点成功后进入 PUBLISHED 状态。
 

package/schemas/.render-manifest.json

@@ -26,16 +26,16 @@
       "bytes": 1744
     },
     "release-plan.schema.json": {
-      "digest": "48b7755dfbeee88ccf78c3200000ab2f5dd06db42bc7b423aed0f81a91cc0418",
-      "bytes": 54672
+      "digest": "3d24cb908cdfbfd5d89551b7c6fed5140f6f1448b9920f114264291ca4cf1c52",
+      "bytes": 55905
     },
     "release-project.schema.json": {
-      "digest": "cc2061799c3a0dd6daea940148e3497b7a4ae8cafb987bf51de7c34c1fed921d",
-      "bytes": 46932
+      "digest": "b0ba3c46692622f734a80d3f4e3904180bbfd1096ca2d9b6d6fd957917e96f73",
+      "bytes": 47688
     },
     "release-run.schema.json": {
-      "digest": "9755a8caa58dd02509ac8e6f869aec5e74d8ae3f7339a3f944977bfad7b729ad",
-      "bytes": 17897
+      "digest": "4a041b8f6488e7d61b7eb271ebdbc2e043731df41c4437783ef63e77f664c192",
+      "bytes": 19002
     }
   }
 }

package/schemas/release-plan.schema.json

@@ -53,6 +53,53 @@
         }
       }
     },
+    "publicSourceAuthorityReceipt": {
+      "type": "object",
+      "required": [
+        "coordinatorUnitId",
+        "subjectUnitIds",
+        "asset"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "coordinatorUnitId": {
+          "type": "string",
+          "pattern": "^(?!\\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._-]*$"
+        },
+        "subjectUnitIds": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^(?!\\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._-]*$"
+          }
+        },
+        "asset": {
+          "type": "object",
+          "required": [
+            "name",
+            "path",
+            "sha256"
+          ],
+          "additionalProperties": false,
+          "properties": {
+            "name": {
+              "const": "source-authority-receipt.json"
+            },
+            "path": {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\).+$"
+            },
+            "sha256": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            }
+          }
+        }
+      }
+    },
     "baseline": {
       "type": "object",
       "required": [

package/schemas/release-project.schema.json

@@ -44,6 +44,30 @@
         }
       }
     },
+    "publicSourceAuthorityReceipt": {
+      "type": "object",
+      "description": "Optional public source-authority receipt uploaded to one coordinator GitHub Release after all subject npm tarballs are frozen.",
+      "required": [
+        "coordinatorUnitId",
+        "subjectUnitIds"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "coordinatorUnitId": {
+          "type": "string",
+          "pattern": "^(?!\\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._-]*$"
+        },
+        "subjectUnitIds": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^(?!\\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._-]*$"
+          }
+        }
+      }
+    },
     "releaseUnits": {
       "type": "array",
       "minItems": 1,

package/schemas/release-run.schema.json

@@ -199,6 +199,11 @@
               },
               "url": {
                 "type": "string"
+              },
+              "integrity": {
+                "type": "string",
+                "pattern": "^sha512-[A-Za-z0-9+/]{86}==$",
+                "description": "Observed npm dist.integrity when an already-consistent npm publish is skipped"
               }
             }
           },
@@ -280,7 +285,42 @@
             "minimum": 0,
             "description": "写入目标的载荷文件数"
           }
-        }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": {
+                "remoteRef": {
+                  "type": "object",
+                  "required": [
+                    "integrity"
+                  ]
+                }
+              },
+              "required": [
+                "remoteRef"
+              ]
+            },
+            "then": {
+              "properties": {
+                "actionType": {
+                  "const": "npm-publish"
+                },
+                "status": {
+                  "const": "skipped"
+                },
+                "preObserve": {
+                  "const": "CONSISTENT"
+                }
+              },
+              "required": [
+                "actionType",
+                "status",
+                "preObserve"
+              ]
+            }
+          }
+        ]
       }
     },
     "sourceAuthorityReceipts": {

package/skills/release-prepare/SKILL.md

@@ -33,6 +33,10 @@ description: Freeze an immutable release plan with local configuration, document
 
 若用户明确要求 GitHub+npm 生产发布，加入 `--production`。该模式还会封存独立
 Git commit/tree 和 npm tarball，并把路径、SHA/integrity、branch/tag 写入计划。
+配置声明 `publicSourceAuthorityReceipt` 时，prepare 必须在所有 subject npm tarball
+冻结后生成 `source-authority-receipt.json`，并把该文件的路径与 SHA-256 绑定到
+coordinator unit 的 `github-release` action。该能力不支持非生产 prepare；不得手工
+补写 receipt 或把私有 plan/run 字段复制进公开文件。
 每个 npm tarball 在计划落盘前必须静态验证 `package.json` 的具体
 `bin`/`main`/`module`/`types`/`typings`/`exports` 入口均为 tarball 内普通文件；
 该门禁不依赖项目是否配置 `requiredPublicFiles` 或 `smokeBin`。通配符 exports 不做

package/skills-src/release-prepare/SKILL.md

@@ -33,6 +33,10 @@ description: Freeze an immutable release plan with local configuration, document
 
 若用户明确要求 GitHub+npm 生产发布，加入 `--production`。该模式还会封存独立
 Git commit/tree 和 npm tarball，并把路径、SHA/integrity、branch/tag 写入计划。
+配置声明 `publicSourceAuthorityReceipt` 时，prepare 必须在所有 subject npm tarball
+冻结后生成 `source-authority-receipt.json`，并把该文件的路径与 SHA-256 绑定到
+coordinator unit 的 `github-release` action。该能力不支持非生产 prepare；不得手工
+补写 receipt 或把私有 plan/run 字段复制进公开文件。
 每个 npm tarball 在计划落盘前必须静态验证 `package.json` 的具体
 `bin`/`main`/`module`/`types`/`typings`/`exports` 入口均为 tarball 内普通文件；
 该门禁不依赖项目是否配置 `requiredPublicFiles` 或 `smokeBin`。通配符 exports 不做

package/src/adapters/git-github.mjs

@@ -8,8 +8,10 @@ import {
   createResult,
   matchObservation,
 } from './contract.mjs';
-import { resolveFrozenPath, verifyFrozenDirectoryStructure } from '../snapshot/frozen.mjs';
+import { resolveFrozenPath, verifyFrozenDirectoryStructure, verifyFrozenFile } from '../snapshot/frozen.mjs';
 import { githubRepositoryUrl } from './push-snapshot.mjs';
+import { digestReleaseAssetIdentities, normalizeReleaseAssets } from '../core/release-assets.mjs';
+import { sha256Hex } from '../core/digest.mjs';
 
 const execFile = promisify(execFileCb);
 const NAME = 'git-github';
@@ -91,6 +93,82 @@ async function readRemoteBranchCommit(action, exec) {
   return stdout.trim().split(/\s+/)[0] ?? '';
 }
 
+async function validateLocalReleaseAssets(action, context) {
+  const assets = normalizeReleaseAssets(action.releaseAssets);
+  const verified = [];
+  for (const asset of assets) {
+    const file = await verifyFrozenFile({
+      root: context.root,
+      filePath: asset.path,
+      expectedSha256: asset.sha256,
+      label: `frozen GitHub Release asset "${asset.name}"`,
+    });
+    verified.push({ ...asset, physical: file.physical });
+  }
+  return verified;
+}
+
+async function readReleaseWithAssets(action, context, exec) {
+  const environment = { ...process.env, GH_HOST: action.githubHost ?? 'github.com' };
+  const { stdout } = await exec(
+    'gh',
+    ['api', `repos/${action.repo}/releases/tags/${action.tag}`],
+    { cwd: context.root, shell: false, encoding: 'utf8', env: environment },
+  );
+  const release = JSON.parse(stdout);
+  const commitResult = await exec(
+    'gh',
+    ['api', `repos/${action.repo}/git/ref/tags/${action.tag}`, '--jq', '.object.sha'],
+    { cwd: context.root, shell: false, encoding: 'utf8', env: environment },
+  );
+  const plannedAssets = normalizeReleaseAssets(action.releaseAssets);
+  const observedAssets = [];
+  const missingAssets = [];
+  for (const planned of plannedAssets) {
+    const matches = (release.assets ?? []).filter((asset) => asset?.name === planned.name);
+    if (matches.length > 1) throw new Error(`GitHub Release has duplicate asset name "${planned.name}"`);
+    if (matches.length === 0) {
+      missingAssets.push(planned.name);
+      continue;
+    }
+    const remote = matches[0];
+    if (!Number.isInteger(remote.id)) throw new Error(`GitHub Release asset "${planned.name}" has no stable asset id`);
+    const downloaded = await exec(
+      'gh',
+      ['api', `repos/${action.repo}/releases/assets/${remote.id}`, '-H', 'Accept: application/octet-stream'],
+      { cwd: context.root, shell: false, encoding: null, env: environment, maxBuffer: 64 * 1024 * 1024 },
+    );
+    const bytes = Buffer.isBuffer(downloaded.stdout)
+      ? downloaded.stdout
+      : Buffer.from(downloaded.stdout ?? '', 'utf8');
+    observedAssets.push({ ...planned, sha256: sha256Hex(bytes) });
+  }
+  return {
+    observation: {
+      tag: release.tag_name,
+      commit: commitResult.stdout.trim(),
+      releaseUrl: release.html_url,
+      ...(missingAssets.length > 0
+        ? { exists: false, missingReleaseAssets: missingAssets }
+        : { releaseAssetsDigest: digestReleaseAssetIdentities(observedAssets) }),
+    },
+    missingAssets,
+    observedAssets,
+  };
+}
+
+function assertExistingReleaseCompatible(action, state) {
+  if (state.observation.tag !== action.tag || state.observation.commit !== action.commit) {
+    throw new Error('existing GitHub Release tag or commit conflicts with the frozen plan');
+  }
+  const expectedByName = new Map(normalizeReleaseAssets(action.releaseAssets).map((asset) => [asset.name, asset]));
+  for (const observed of state.observedAssets) {
+    if (expectedByName.get(observed.name)?.sha256 !== observed.sha256) {
+      throw new Error(`GitHub Release asset "${observed.name}" bytes conflict with the frozen plan`);
+    }
+  }
+}
+
 export function createGitGithubAdapter(deps = {}) {
   const exec = deps.exec ?? run;
   return Object.freeze({
@@ -110,6 +188,7 @@ export function createGitGithubAdapter(deps = {}) {
         } else if (action.actionType === ActionType.GITHUB_RELEASE) {
           if (!action.repo || !action.tag) throw new Error('github-release requires repo, tag, and commit');
           validateOid(action.commit);
+          const localAssets = await validateLocalReleaseAssets(action, context);
           await exec('gh', ['auth', 'status'], {
             cwd: context.root,
             shell: false,
@@ -123,12 +202,19 @@ export function createGitGithubAdapter(deps = {}) {
             throw new Error(`cannot access GitHub repository ${action.repo}: ${err.message}`);
           });
           try {
-            await exec('gh', ['api', `repos/${action.repo}/releases/tags/${action.tag}`], {
-              cwd: context.root,
-              shell: false,
-              env: { ...process.env, GH_HOST: action.githubHost ?? 'github.com' },
-            });
-            throw new Error(`GitHub Release already exists for ${action.tag}; human intervention required`);
+            if (localAssets.length === 0) {
+              await exec('gh', ['api', `repos/${action.repo}/releases/tags/${action.tag}`], {
+                cwd: context.root,
+                shell: false,
+                env: { ...process.env, GH_HOST: action.githubHost ?? 'github.com' },
+              });
+              throw new Error(`GitHub Release already exists for ${action.tag}; human intervention required`);
+            }
+            const state = await readReleaseWithAssets(action, context, exec);
+            assertExistingReleaseCompatible(action, state);
+            if (state.missingAssets.length === 0) {
+              throw new Error(`GitHub Release and assets already exist for ${action.tag}`);
+            }
           } catch (err) {
             if (err.message?.includes('already exists')) throw err;
             if (!isNotFound(err)) throw new Error(`cannot determine GitHub Release uniqueness: ${err.message}`);
@@ -192,13 +278,36 @@ export function createGitGithubAdapter(deps = {}) {
             `refs/tags/${action.tag}`,
           ], { shell: false });
         } else if (action.actionType === ActionType.GITHUB_RELEASE) {
-          await exec('gh', [
-            'release', 'create', action.tag,
-            '--repo', ghRepo(action),
-            '--verify-tag',
-            '--title', action.name ?? `Release ${action.tag}`,
-            '--notes', action.notes ?? `Release ${action.tag}`,
-          ], { cwd: context.root, shell: false, env: { ...process.env, GH_HOST: action.githubHost ?? 'github.com' } });
+          const assets = await validateLocalReleaseAssets(action, context);
+          let existing = null;
+          if (assets.length > 0) {
+            try {
+              existing = await readReleaseWithAssets(action, context, exec);
+            } catch (error) {
+              if (!isNotFound(error)) throw error;
+            }
+          }
+          if (existing) {
+            assertExistingReleaseCompatible(action, existing);
+            const missing = new Set(existing.missingAssets);
+            const uploadPaths = assets.filter((asset) => missing.has(asset.name)).map((asset) => asset.physical);
+            if (uploadPaths.length > 0) {
+              await exec('gh', ['release', 'upload', action.tag, '--repo', ghRepo(action), ...uploadPaths], {
+                cwd: context.root,
+                shell: false,
+                env: { ...process.env, GH_HOST: action.githubHost ?? 'github.com' },
+              });
+            }
+          } else {
+            await exec('gh', [
+              'release', 'create', action.tag,
+              '--repo', ghRepo(action),
+              '--verify-tag',
+              '--title', action.name ?? `Release ${action.tag}`,
+              '--notes', action.notes ?? `Release ${action.tag}`,
+              ...assets.map((asset) => asset.physical),
+            ], { cwd: context.root, shell: false, env: { ...process.env, GH_HOST: action.githubHost ?? 'github.com' } });
+          }
         } else if (action.actionType === ActionType.SET_DEFAULT_BRANCH) {
           validateDefaultBranchAction(action);
           const { stdout: current } = await exec('gh', ['api', `repos/${action.repo}`, '--jq', '.default_branch'], {
@@ -242,18 +351,22 @@ export function createGitGithubAdapter(deps = {}) {
           const { remoteUrl } = await validateTagAction(action, context, exec);
           observation = { tag: action.tag, commit: await readRemoteTag(action, remoteUrl, exec) };
         } else if (action.actionType === ActionType.GITHUB_RELEASE) {
-          const { stdout } = await exec('gh', [
-            'release', 'view', action.tag,
-            '--repo', ghRepo(action),
-            '--json', 'tagName,url',
-          ], { cwd: context.root, shell: false, env: { ...process.env, GH_HOST: action.githubHost ?? 'github.com' } });
-          const release = JSON.parse(stdout);
-          const commitResult = await exec(
-            'gh',
-            ['api', `repos/${action.repo}/git/ref/tags/${action.tag}`, '--jq', '.object.sha'],
-            { cwd: context.root, shell: false, env: { ...process.env, GH_HOST: action.githubHost ?? 'github.com' } },
-          );
-          observation = { tag: release.tagName, commit: commitResult.stdout.trim(), releaseUrl: release.url };
+          if (normalizeReleaseAssets(action.releaseAssets).length > 0) {
+            observation = (await readReleaseWithAssets(action, context, exec)).observation;
+          } else {
+            const { stdout } = await exec('gh', [
+              'release', 'view', action.tag,
+              '--repo', ghRepo(action),
+              '--json', 'tagName,url',
+            ], { cwd: context.root, shell: false, env: { ...process.env, GH_HOST: action.githubHost ?? 'github.com' } });
+            const release = JSON.parse(stdout);
+            const commitResult = await exec(
+              'gh',
+              ['api', `repos/${action.repo}/git/ref/tags/${action.tag}`, '--jq', '.object.sha'],
+              { cwd: context.root, shell: false, env: { ...process.env, GH_HOST: action.githubHost ?? 'github.com' } },
+            );
+            observation = { tag: release.tagName, commit: commitResult.stdout.trim(), releaseUrl: release.url };
+          }
         } else if (action.actionType === ActionType.SET_DEFAULT_BRANCH) {
           validateDefaultBranchAction(action);
           const { stdout: current } = await exec('gh', ['api', `repos/${action.repo}`, '--jq', '.default_branch'], {