It could be even like this: https://github.com/besser82/pipelight-selinux/archive/v0.3.1.tar.gz

which is more natural looking at the archives page https://github.com/besser82/pipelight-selinux/releases

Previously, there was a bit vague wording at [1] which raised questions, you can see the difference here [2].
"For a number of reasons (immutability, availability, uniqueness), you must use the full commit revision hash when referring to the sources" looked like a requirement to use commit hashes all the time.
Now it's gone so we can rely on the statement "If the upstream does create tarballs you should use them as tarballs provide an easier trail for people auditing the packages", assuming that GitHub created that archive for us. Sure, it doesn't create it in advance but since it generates it properly (preserving file modification time, and such) we can consider it as an ordinary static tarball.