In our review guidelines we defined:
Is another module added as a dependency? Add it to the .fixtures.yml file as a git repository (as a https:// link, not ssh or git://). Spec tests always run against master branches to detect breaking changes as early as possible. Acceptance tests use the last release (installed by install_module_dependencies which parses it from the metadata.json)
This also applies for the source attribute in the metadata.json. I would be very helpful to have a linter plugin that validues those URLs.