chore(renovate): document patch-coverage gate and sole-bot policy

[JSONbored]

Context

Follow-up to the coverage-gate change (#763) and the duplicate hono advisory PRs (#760 from Renovate, #761 from Dependabot security updates).

Why two PRs for one advisory

The repo had no dependabot.yml (Dependabot wasn't doing version updates), but GitHub's Dependabot security updates toggle (automated-security-fixes) was enabled. That toggle auto-raises PRs for advisories independently of Renovate — and Renovate's own vulnerabilityAlerts was already covering the same feed. One hono advisory → two PRs.

Changes

Repo setting (already applied, not in this diff): disabled Dependabot security updates via the API (automated-security-fixes is now enabled: false). Renovate remains the sole bot; its vulnerabilityAlerts still covers security advisories, so nothing is left unwatched — there's just no duplicate.

This diff (renovate.json):

• prBodyNotes referenced the old "97% global coverage gate" that ci(coverage): gate on patch coverage via Codecov, not global threshold #763 replaced. Updated to describe the Codecov patch-coverage gate, so Renovate stops stamping stale guidance on every dependency PR.
• Recorded that Renovate is the sole dependency/security bot and Dependabot security updates is disabled.

CI note

validate will be red on the npm audit step until the hono bump (#760) lands on main; this branch will go green after a sync with main. Config-only change — no code touched.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#764 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 1 changed file(s) — two independent AI reviewers.

Changed files: renovate.json

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR updates the Renovate configuration's PR body notes to clarify that coverage is enforced via Codecov patch coverage and to document the policy that Renovate is the sole dependency/security‑update bot. No code changes, tests, or security-sensitive logic are affected.

Suggestions

• Consider adding a brief note in the repository's CONTRIBUTING or README file about the sole‑bot policy for future maintainers.
• Verify that Dependabot is indeed disabled elsewhere to keep the documentation accurate.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR updates renovate.json documentation to clarify the coverage gate policy (emphasizing Codecov patch coverage over global thresholds) and documents the repository's dependency bot policy (Renovate as sole bot, Dependabot disabled). The changes are non-functional, accurate per existing codecov.yml and vitest.config.ts, and pose no risks.

No blocking issues spotted.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.59%. Comparing base (664815f) to head (25be710).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #764   +/-   ##
=======================================
  Coverage   96.59%   96.59%           
=======================================
  Files          91       91           
  Lines       13646    13646           
  Branches     4975     4975           
=======================================
  Hits        13182    13182           
  Misses         97       97           
  Partials      367      367           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.