use the sha of the release instead of the tag