Until a package registry release exists, pin the complete Git commit identifier at the consumer boundary:
uvx --from "git+https://github.com/leynos/typos-config-builder.git@FULL_COMMIT_SHA" \
typos-config-builder --check
Replace FULL_COMMIT_SHA with the selected commit. The exact revision makes
policy changes reviewable. Consumers should not invoke an unpinned branch or
latest revision.
After registry publication, the equivalent form pins the released package version:
uvx --from typos-config-builder==X.Y.Z typos-config-builder --check