uvx-gh
Thin wrapper to uvx-run a tool published as a GitHub repo at github.com/<user>/<tool>[@<ref>].
Install
# One-off run
uvx uvx-gh alice/foo
# Or install
pip install uvx-gh
# pip install git+https://github.com/qsoyq/uvx-gh.git # latest from GitHub
Usage
uvx-gh [uvx-options...] USER/TOOL[@REF] [tool-args...]
uvx-gh [uvx-options...] --user USER TOOL[@REF] [tool-args...]
The USER/TOOL short path takes priority over --user. Either is required.
Ref suffix
| Spec | Behavior |
|---|---|
alice/foo |
use locally cached HEAD sha; first call resolves via git ls-remote and persists |
alice/foo@latest |
force re-resolve HEAD via git ls-remote and overwrite the cached sha |
alice/foo@v1.2.3 |
pin to git ref (tag / branch / sha) directly — bypasses the sha cache |
Extras (PEP 508)
Append [extras] to the tool name to request optional dependency groups, just like pip install pkg[extras]:
# httpx CLI requires the [cli] extras (click + pygments + rich) to actually run
uvx-gh encode/httpx[cli] -- https://example.com
# Multiple extras + a pinned ref
uvx-gh "encode/httpx[cli,http2]@master" -- https://example.com
Internally this becomes a PEP 508 direct reference forwarded to uvx:
uvx --from "httpx[cli] @ git+https://github.com/encode/httpx@<sha>" httpx ...
Extras do not participate in the sha cache key — the same <user>/<tool> shares one ls-remote result across every extras combination, and @latest on any variant refreshes the sha for all of them. uv keeps a separate venv per extras combination under ~/.cache/uv/environments-v2/<hash>/.
Quote the spec when extras contain commas, otherwise the shell may treat
,or brackets specially in some contexts.
--no-git (skip the system git binary)
uv itself shells out to the system git binary when installing a git+https:// source. On hosts without git (typical Windows boxes that only have uv installed), the install fails with Git executable not found.
Pass --no-git (or set UVX_GH_NO_GIT=1) to emit a GitHub archive tarball URL instead — uv then downloads over plain HTTP and never calls git:
uvx-gh --no-git qsoyq/ai-assistant -- --help
# → uvx --from "https://github.com/qsoyq/ai-assistant/archive/<sha>.tar.gz" ai-assistant --help
Caveats:
- Public repos only. Private repos still need git credentials.
uvdoes not reuse a git checkout cache for tarballs, so each new sha re-downloads.
Why the sha cache?
uvx --from git+https://... (without a pinned commit) makes uv re-fetch HEAD from GitHub on every call — that's a network roundtrip per invocation. uvx-gh resolves HEAD itself via the smart-HTTP ls-remote protocol (using dulwich, no system git needed) and pins the URL to the resolved sha (git+...@<sha>). After the first run, subsequent calls hit the local cache and incur zero network traffic until you explicitly use @latest.
Cache location:
$UVX_GH_CACHE_HOMEif set- otherwise
$XDG_CACHE_HOME/uvx-gh/(default~/.cache/uvx-gh/)
Layout: <cache_dir>/github.com/<user>/<tool> containing the sha as a single line.
Pass-through
Anything the wrapper does not recognize is forwarded:
- Tokens before
TOOL_SPECgo touvx(e.g.--python 3.12,--with extras) - Tokens after
TOOL_SPECgo to the tool itself --ends wrapper-arg parsing; everything after--is treated as tool args
uvx-gh --python 3.12 alice/foo --port 8080
# → uvx --python 3.12 --from git+https://github.com/alice/foo foo --port 8080
uvx-gh -- alice/foo --user bob
# → uvx --from git+https://github.com/alice/foo foo --user bob
# (--user bob is forwarded to foo, NOT consumed by uvx-gh)
Requirements
uvx-gh depends on the uv toolchain (which provides the uvx binary). It does not require the system git CLI — HEAD resolution uses dulwich (pure Python, bundled as a runtime dep).
Install uv:
| Platform | Command |
|---|---|
| macOS | brew install uv |
| Linux | curl -LsSf https://astral.sh/uv/install.sh | sh |
| Windows | winget install --id=astral-sh.uv -e |
| Any | pipx install uv |
uvx-gh runs a pre-flight check at startup and exits with a friendly message if uvx is not on PATH.
Notes
- On Windows,
os.execvpis emulated; signal/exit-code semantics differ slightly from POSIX. - The
UVX_VALUE_FLAGSwhitelist inuvx_gh/commands/main.pyis hand-synced withuv's value-taking flags. Use--flag=valueform to bypass the whitelist if a new uv flag is missing.
Metadata
Release files for uvx-gh 0.1.5
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| uvx_gh-0.1.5.tar.gz | 39.6 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| uvx_gh-0.1.5-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 50.3 kB
Release files / uvx_gh-0.1.5.tar.gz
| Download URL | uvx_gh-0.1.5.tar.gz |
|---|---|
| Size | 39.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
a86298ee9c140831f4b0e167388bd18c74fda9d19335cd1987a9519717360fee
|
|
BLAKE2b-256 checksum How to use checksums |
dc61fe604586293e1afecbb1349556bef81b1fe8982039c3ea2bd75a2e9cd2a5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.11.15 {"installer":{"name":"uv","version":"0.11.15","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / uvx_gh-0.1.5-py3-none-any.whl
| Download URL | uvx_gh-0.1.5-py3-none-any.whl |
|---|---|
| Size | 10.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
5f84e5668f1d50f84b2dd48c7611853c8f197370f0d8ba8c38ddddee384aa833
|
|
BLAKE2b-256 checksum How to use checksums |
2024b9e20bbd55c09b7193fe4446da45d6f7e711a12c33e444466b7cba46a892
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.11.15 {"installer":{"name":"uv","version":"0.11.15","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Security for uvx-gh 0.1.5
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.