[ML] Auto-approve automated version-bump PRs - #3137
Merged
edsavage merged 2 commits intoAug 5, 2026
Merged
Conversation
The automated version-bump PRs already arm auto-merge but stalled on the single required review. Add a workflow that approves them as github-actions[bot] (a distinct identity from the vault-app author, mirroring the Backport workflow), gated to the bump topic branch + author and to a diff that only touches gradle.properties. Auto-merge then lands them on green CI. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Pinging @elastic/ml-core (Team:ML) |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow to automatically approve automated version-bump pull requests so that already-armed auto-merge can complete once required CI is green. This targets only the version-bump automation path and uses pull_request_target with minimal permissions to avoid executing PR code.
Changes:
- Introduces
.github/workflows/auto-approve-version-bump.ymlto auto-approve version-bump PRs authored byelastic-vault-github-plugin-prod[bot]. - Guards approval by requiring the head branch prefix
ci/ml-cpp-version-bump-and restricting the diff to onlygradle.properties. - Avoids stacking duplicate approvals by checking for an existing
github-actions[bot]approval before approving.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Query the PR reviews endpoint with --paginate --slurp so the "already approved by github-actions[bot]" check counts across all pages, not just the first 30. Co-authored-by: Cursor <cursoragent@cursor.com>
This was referenced Aug 5, 2026
Contributor
💚 All backports created successfully
Questions ?Please refer to the Backport tool documentation and see the Github Action logs for details |
edsavage
added a commit
that referenced
this pull request
Aug 5, 2026
The automated version-bump PRs already arm auto-merge but stalled on the single required review. Add a workflow that approves them as github-actions[bot] (a distinct identity from the vault-app author, mirroring the Backport workflow), gated to the bump topic branch + author and to a diff that only touches gradle.properties. Auto-merge then lands them on green CI. --------- (cherry picked from commit 68fb7cc) Co-authored-by: Ed Savage <ed.savage@elastic.co> Co-authored-by: Cursor <cursoragent@cursor.com>
edsavage
added a commit
that referenced
this pull request
Aug 5, 2026
The automated version-bump PRs already arm auto-merge but stalled on the single required review. Add a workflow that approves them as github-actions[bot] (a distinct identity from the vault-app author, mirroring the Backport workflow), gated to the bump topic branch + author and to a diff that only touches gradle.properties. Auto-merge then lands them on green CI. --------- (cherry picked from commit 68fb7cc) Co-authored-by: Ed Savage <ed.savage@elastic.co> Co-authored-by: Cursor <cursoragent@cursor.com>
edsavage
added a commit
that referenced
this pull request
Aug 5, 2026
The automated version-bump PRs already arm auto-merge but stalled on the single required review. Add a workflow that approves them as github-actions[bot] (a distinct identity from the vault-app author, mirroring the Backport workflow), gated to the bump topic branch + author and to a diff that only touches gradle.properties. Auto-merge then lands them on green CI. --------- (cherry picked from commit 68fb7cc) Co-authored-by: Ed Savage <ed.savage@elastic.co> Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The automated version-bump PRs (
dev-tools/bump_version.sh, e.g. #3135) already arm auto-merge, but stalled on the single required approving review — a human still had to click Approve. This adds a workflow that supplies that approval automatically.github-actions[bot](this workflow'sGITHUB_TOKEN) approves the PR. Because the PR was authored byelastic-vault-github-plugin-prod[bot],github-actions[bot]is a distinct identity and its approval counts — GitHub forbids self-approval. This is the same mechanism the Backport workflow already uses, and the repo has "Allow GitHub Actions to approve pull requests" enabled. The armed auto-merge then lands the PR once required CI (buildkite/ml-cpp-pr-builds) is green — CI still gates the merge.Guards / safety
elastic-vault-github-plugin-prod[bot]and head branch matchesci/ml-cpp-version-bump-*(the topic branch frombump_version.sh).gradle.properties; anything broader is skipped and left for a human.github-actions[bot]already approved (reopened PRs re-trigger).contents,pull-requests: write; does not check out or run PR code (safe underpull_request_target).Backport note
pull_request_targetreads the workflow from the PR's base branch, and bump PRs target release branches — so this file must also live on each active release branch (9.5,9.4,8.19). Version labels will be added to backport it there. Until then, release-branch bump PRs still need a manual approval.Test plan
bash -ncleanmain(minor freeze) or a backported branch:github-actions[bot]approves automatically and auto-merge lands it on green CIci/ml-cpp-version-bump-*branch touching a file other thangradle.propertiesis not auto-approvedMade with Cursor