Some github tarball URIs are dynamically generated and can/will change over time. These should cause a QA warning.
Did some digging and research, assuming the tag doesn't change the resulting tarball from git archive (which is what the download button uses internally) is always identical as git ensures the timestamps are the commit timestamps. Thus, not a problem.
verified per above comment as invalid