fix: auto-approve automated version bump PRs

.github/workflows/auto-approve-version-bump.yaml

@@ -0,0 +1,42 @@
+name: Auto-approve version bump PRs
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  approve:
+    # Main requires one approving review (public repo), but bump PRs are authored
+    # by the PAT owner, who can't approve their own PR. Approve machine-generated
+    # bump PRs as github-actions[bot] instead. Guards keep this unusable for real
+    # code: same-repo branch only (fork PRs get a read-only token anyway) and the
+    # diff must be exactly the DESCRIPTION Version line.
+    if: >-
+      startsWith(github.head_ref, 'chore/bump-version-') &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Verify the diff is only the DESCRIPTION version line
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          FILES=$(gh api "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" --jq '.[].filename')
+          if [ "$FILES" != "DESCRIPTION" ]; then
+            echo "PR must touch only DESCRIPTION (saw: $FILES) — not approving."
+            exit 1
+          fi
+
+          PATCH=$(gh api "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" --jq '.[0].patch')
+          if echo "$PATCH" | grep -E '^[+-]' | grep -qvE '^[+-]Version: [0-9.]+$'; then
+            echo "DESCRIPTION diff goes beyond the Version line — not approving."
+            exit 1
+          fi
+
+      - name: Approve
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh pr review "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}" --approve