From c2b4a32e68217ec14dd757516df42f05bb1b0dae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Jerci=C5=84ski?= <lukasz@jercin.ski>
Date: Fri, 12 Jun 2026 13:18:24 +0200
Subject: [PATCH 1/3] fix: adopt pnpm 11.6.0 and the consolidated pr-review
 workflow

---
 .github/workflows/pr-review-on-push.yml       | 27 -------------------
 .../{pr-review-on-open.yml => pr-review.yml}  | 21 ++++++++++++---
 package.json                                  |  2 +-
 3 files changed, 19 insertions(+), 31 deletions(-)
 delete mode 100644 .github/workflows/pr-review-on-push.yml
 rename .github/workflows/{pr-review-on-open.yml => pr-review.yml} (52%)

diff --git a/.github/workflows/pr-review-on-push.yml b/.github/workflows/pr-review-on-push.yml
deleted file mode 100644
index 5ab565e..0000000
--- a/.github/workflows/pr-review-on-push.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-name: PR Code Review
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: "PR number to review"
-        required: true
-        type: number
-
-jobs:
-  review:
-    permissions:
-      contents: read
-      pull-requests: write
-      actions: read
-    uses: Jercik/axgithub/.github/workflows/pr-review.yml@v1
-    with:
-      label: code
-      recipes: '["pr-review-code-1","pr-review-code-2"]'
-      pr_number: ${{ github.event.pull_request.number || inputs.pr_number }}
-    secrets:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      AXRECIPE_API_KEY: ${{ secrets.AXRECIPE_API_KEY }}
diff --git a/.github/workflows/pr-review-on-open.yml b/.github/workflows/pr-review.yml
similarity index 52%
rename from .github/workflows/pr-review-on-open.yml
rename to .github/workflows/pr-review.yml
index 9fdc479..3d948b0 100644
--- a/.github/workflows/pr-review-on-open.yml
+++ b/.github/workflows/pr-review.yml
@@ -1,9 +1,9 @@
 ---
-name: PR Approach Review
+name: PR Review
 
 on:
   pull_request_target:
-    types: [opened]
+    types: [opened, synchronize, reopened]
   workflow_dispatch:
     inputs:
       pr_number:
@@ -12,7 +12,8 @@ on:
         type: number
 
 jobs:
-  review:
+  approach:
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.action == 'opened' }}
     permissions:
       contents: read
       pull-requests: write
@@ -25,3 +26,17 @@ jobs:
     secrets:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       AXRECIPE_API_KEY: ${{ secrets.AXRECIPE_API_KEY }}
+
+  code:
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
+    uses: Jercik/axgithub/.github/workflows/pr-review.yml@v1
+    with:
+      label: code
+      recipes: '["pr-review-code-1","pr-review-code-2"]'
+      pr_number: ${{ github.event.pull_request.number || inputs.pr_number }}
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      AXRECIPE_API_KEY: ${{ secrets.AXRECIPE_API_KEY }}
diff --git a/package.json b/package.json
index d7ee34c..ce2416b 100644
--- a/package.json
+++ b/package.json
@@ -81,5 +81,5 @@
   "engines": {
     "node": ">=24.0.0"
   },
-  "packageManager": "pnpm@11.5.1"
+  "packageManager": "pnpm@11.6.0"
 }

From 4580004fc3cffafe858ff09c68b801c41d044896 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Jerci=C5=84ski?= <lukasz@jercin.ski>
Date: Sat, 13 Jun 2026 06:50:55 +0200
Subject: [PATCH 2/3] fix: invoke conventional-commit-msg via npm exec to
 survive npm_config_package leak

---
 .githooks/commit-msg | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.githooks/commit-msg b/.githooks/commit-msg
index 721581a..c611808 100755
--- a/.githooks/commit-msg
+++ b/.githooks/commit-msg
@@ -1,2 +1,6 @@
 #!/usr/bin/env bash
-npx -y conventional-commit-msg "$1"
\ No newline at end of file
+# `npm exec --package=` over `npx -y`: an explicit --package overrides any
+# inherited npm_config_package env var. Agent wrappers (axexec/axrun) set it to
+# their own package, which makes bare `npx -y conventional-commit-msg` resolve
+# the wrong package and exit 127 on every commit.
+npm exec --yes --package=conventional-commit-msg -- conventional-commit-msg "$1"

From 36c0ddde17cbeaca39fc53bc945650141382397e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Jerci=C5=84ski?= <lukasz@jercin.ski>
Date: Sat, 13 Jun 2026 07:06:04 +0200
Subject: [PATCH 3/3] fix: pin commit-msg hook to
 conventional-commit-msg@latest to dodge local-root shadowing

---
 .githooks/commit-msg | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/.githooks/commit-msg b/.githooks/commit-msg
index c611808..a8a29d3 100755
--- a/.githooks/commit-msg
+++ b/.githooks/commit-msg
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
-# `npm exec --package=` over `npx -y`: an explicit --package overrides any
-# inherited npm_config_package env var. Agent wrappers (axexec/axrun) set it to
-# their own package, which makes bare `npx -y conventional-commit-msg` resolve
-# the wrong package and exit 127 on every commit.
-npm exec --yes --package=conventional-commit-msg -- conventional-commit-msg "$1"
+# `@latest` + explicit `--package` dodge two npm footguns: an inherited
+# npm_config_package (agent wrappers like axexec/axrun set it, hijacking
+# `npx -y` into exit 127), and local-root shadowing — without the version,
+# `npm exec` resolves the conventional-commit-msg repo's own package and the
+# bin is "not found", breaking the hook in that repo after prepare wires it up.
+npm exec --yes --package=conventional-commit-msg@latest -- conventional-commit-msg "$1"