@asottile per your mention about "reproducible builds" for the tar.gz files it could be accomplished in a Github-specific way by updating make-archives to grab the URLs like this instead of doing a git clone:

https://github.com/rbenv/rbenv/archive/585ed84283f3308380b843391ee7b12706ecff87.tar.gz

Looks like it also supports short shas (but the resulting file is the full git sha):
https://github.com/rbenv/ruby-build/archive/e9fa4bf.tar.gz

It also looks like calling that repeatedly produces a tar file with the same sha1sum so in a way that is "reproducible" and can be added to CI checks.

This would work for the given set of REPOS since they're all hosted on Github, but wouldn't work if other git hosting providers are added to that list.

I'll rebase this on #1915 once that merges!