From 25be7103054444ff215218e218904011db83b6c1 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Tue, 16 Jun 2026 14:45:49 -0700
Subject: [PATCH] chore(renovate): document patch-coverage gate and sole-bot
 policy

Two follow-ups from the coverage-gate change (#763) and the duplicate hono
advisory PRs (#760 from Renovate, #761 from Dependabot security updates):

- prBodyNotes referenced the old "97% global coverage gate" that #763 replaced.
  Update it to describe the Codecov patch-coverage gate so Renovate stops
  stamping stale guidance on every dependency PR.
- Record that Renovate is the sole dependency/security bot. GitHub Dependabot
  security updates has been disabled at the repo level (automated-security-fixes)
  so a single advisory no longer produces two PRs; Renovate's vulnerabilityAlerts
  continues to cover security advisories.
---
 renovate.json | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/renovate.json b/renovate.json
index 4c5a13aaf5..1a98650f59 100644
--- a/renovate.json
+++ b/renovate.json
@@ -41,8 +41,9 @@
   ],
   "postUpdateOptions": ["npmDedupe"],
   "prBodyNotes": [
-    "Dependency PRs must keep `npm run test:ci` passing and preserve the 97% global coverage gate.",
-    "GitHub Actions updates must remain SHA-pinned."
+    "Dependency PRs must keep `npm run test:ci` passing. The 97% coverage requirement is enforced as Codecov patch coverage on changed lines (codecov/patch), so dependency-only bumps satisfy it without new tests.",
+    "GitHub Actions updates must remain SHA-pinned.",
+    "Renovate is the sole dependency and security-update bot for this repo; GitHub Dependabot security updates are disabled to avoid duplicate PRs (e.g. the two hono advisory PRs)."
   ],
   "prConcurrentLimit": 5,
   "prHourlyLimit": 2,