Use `git show 340c3119f9661343b5067bf848aaee0ac56a0028:.SRCINFO` to check what the AUR validator is actually looking at.
That was the key! It would seem that the hook analyzes individual commits, but not the last version. I started out without file://, but added it on the second commit. Squashing it all together and doing a force push solved the problem. Thanks :)