npm will translate the git branch to its commit sha when you `npm shrinkwrap` so you're pretty well covered.