Well, actually you don't download from GitHub - you download from the central mirror proxy operated by Google, and that will always return the same package given the same versioned reference, even if the original source differs from it.