The hash is not referring to a commit but simply used for signing the URL. It's not really necessary for public projects, but for private ones where you want to have the badge somewhere.