Developer Simon Willison published a concise recipe for running uvx tools inside GitHub Actions without hitting PyPI on every build. The trick centres on UV_EXCLUDE_NEWER, a uv environment variable that pins package resolution to a specific date. That same date string doubles as the GitHub Actions cache key, so developers only need to maintain one value to control both the installed versions and cache invalidation — no separate requirements file required.
The workflow pairs astral-sh/setup-uv with three non-default settings: cache-dependency-glob is blanked so uv stops looking for pyproject.toml, cache-suffix is set to the UV_EXCLUDE_NEWER date, and prune-cache is set to false (overriding Astral's default of deliberately discarding cached wheels). A guard step then sets UV_OFFLINE=1 on cache hits, so any tool missing from the cache causes an explicit failure rather than a silent network fetch. Willison notes this deliberately trades a small speed penalty against eliminating per-run PyPI CDN calls — a tradeoff many ML teams running llm, datasette, or similar tooling in CI will recognise immediately.