The github guidelines sugges using
{{{
https://github.com/$OWNER/$PROJECT/archive/%{commit}/%{name}-%{version}-%{shortcommit}.tar.gz
}}}
as download url. Apparently that URL broke soon after the guidelines were approved, and the link above will now download a file called
{{{
$project-$commit.tar.gz
}}}

In python-pillow, I ended up using:
{{{

Refer to the comment for Source0 below on how to obtain the source tarball

The saved file has format $owner-$project-$version-$ahead-g$shortcommit.tar.gz

%global commit $commit
%global shortcommit %(c=%{commit}; echo ${c:0:7})
%global ahead $ahead
[...]

Obtain the tarball for a certain commit via:

wget --content-disposition https://github.com/$owner/$project/tarball/$commit

Source0: https://github.com/$owner/$project/tarball/%{commit}/$owner-$project-%{version}-%{ahead}-g%{shortcommit}.tar.gz
}}}
Note: if there are no version tags, the format of the file is
{{{
$owner-$project-$ahead-g$shortcommit.tar.gz
}}}

Might this be a better alternative for the guidelines?

A proposed change to the guidelines is attached.