[ML] Auto-approve automated version-bump PRs

[edsavage]

Summary

The automated version-bump PRs (dev-tools/bump_version.sh, e.g. #3135) already arm auto-merge, but stalled on the single required approving review — a human still had to click Approve. This adds a workflow that supplies that approval automatically.

github-actions[bot] (this workflow's GITHUB_TOKEN) approves the PR. Because the PR was authored by elastic-vault-github-plugin-prod[bot], github-actions[bot] is a distinct identity and its approval counts — GitHub forbids self-approval. This is the same mechanism the Backport workflow already uses, and the repo has "Allow GitHub Actions to approve pull requests" enabled. The armed auto-merge then lands the PR once required CI (buildkite/ml-cpp-pr-builds) is green — CI still gates the merge.

Guards / safety

• Fires only when both: author is elastic-vault-github-plugin-prod[bot] and head branch matches ci/ml-cpp-version-bump-* (the topic branch from bump_version.sh).
• Diff safety belt: approves only if the PR's sole changed file is gradle.properties; anything broader is skipped and left for a human.
• Idempotent: skips if github-actions[bot] already approved (reopened PRs re-trigger).
• Read-only contents, pull-requests: write; does not check out or run PR code (safe under pull_request_target).

Backport note

pull_request_target reads the workflow from the PR's base branch, and bump PRs target release branches — so this file must also live on each active release branch (9.5, 9.4, 8.19). Version labels will be added to backport it there. Until then, release-branch bump PRs still need a manual approval.

Test plan

• YAML parses; embedded bash bash -n clean
• On next automated bump PR into main (minor freeze) or a backported branch: github-actions[bot] approves automatically and auto-merge lands it on green CI (pending next automated version bump — per the Elastic release schedule the next patch cycle is 8.19.21 / 9.4.6: Feature Freeze Tue 25 Aug 2026, GA Tue 01 Sep 2026; then 9.5.2 FF 8 Sep 2026)
• A hand-crafted PR on a ci/ml-cpp-version-bump-* branch touching a file other than gradle.properties is not auto-approved (not schedule-dependent — can be verified manually at any time)

Made with Cursor

[elasticsearchmachine]

Pinging @elastic/ml-core (Team:ML)

[Copilot]

Pull request overview

Adds a GitHub Actions workflow to automatically approve automated version-bump pull requests so that already-armed auto-merge can complete once required CI is green. This targets only the version-bump automation path and uses pull_request_target with minimal permissions to avoid executing PR code.

Changes:

• Introduces .github/workflows/auto-approve-version-bump.yml to auto-approve version-bump PRs authored by elastic-vault-github-plugin-prod[bot].
• Guards approval by requiring the head branch prefix ci/ml-cpp-version-bump- and restricting the diff to only gradle.properties.
• Avoids stacking duplicate approvals by checking for an existing github-actions[bot] approval before approving.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[elastic-vault-github-plugin-prod]

💚 All backports created successfully

Status	Branch	Result
✅	8.19
✅	9.4
✅	9.5

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details

[edsavage]

Test-plan status (2026-08-10): the post-merge verification items here are pending the next automated version bump — none has run since this merged (the last bump, #3135 for 9.5.1, was on 2026-08-04, before this landed). Not forgotten; they'll be exercised and confirmed on the next bump.