So far as I understand it, messages are associated with commits. But when you look at a repo on GitHub it helpfully lists the message by each file, for when it was last changed.
In search of building permanent links, I found one of the easiest way to retrieve the commit sha is to actually parse the html page.
Benefits:
There is a link called Permalink on every file page.
If you are looking for ways to identify that link
there is the class .js-permalink-shortcut and also the data-hotkey="y" attribute, as described in Getting permanent links to files - Github.
Permalink
So in this example the sha is a6f4038336ff41463ad527b4ff4fda45642ebc6d.
Note, it will always be rendered, even if you are already on that commit.
In case somebody likes to build a permalink from it, the url hash (e.g. line references like #L437-L441) needs to be kept (appended) manually.