chore(ci): auto-approve SPM bot PRs and tag on merge

.github/workflows/auto-approve-spm-bot-prs.yml

@@ -0,0 +1,47 @@
+name: Auto Approve SPM Bot PRs
+
+on:
+  pull_request:
+    types: [opened]
+
+permissions:
+  pull-requests: write
+  contents: write
+
+jobs:
+  auto-approve:
+    runs-on: ubuntu-latest
+    # Only act on bot-created PRs that publish a new SPM version. The branch
+    # prefix is set by the publisher workflow in BidMachine-MGP-SDK
+    # (.github/workflows/ios-build-sdk.yml).
+    if: startsWith(github.event.pull_request.head.ref, 'bot/spm-')
+    steps:
+      - name: Approve and squash-merge
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr review ${{ github.event.pull_request.number }} \
+            --repo "${{ github.repository }}" --approve
+          gh pr merge ${{ github.event.pull_request.number }} \
+            --repo "${{ github.repository }}" --squash --delete-branch
+
+      - name: Create version tag
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Branch name is `bot/spm-<version>`; the tag is just <version>.
+          VERSION="${{ github.event.pull_request.head.ref }}"
+          VERSION="${VERSION#bot/spm-}"
+          if [ -z "$VERSION" ]; then
+            echo "Could not extract version from branch name"
+            exit 1
+          fi
+
+          MERGE_SHA=$(gh pr view ${{ github.event.pull_request.number }} \
+            --repo "${{ github.repository }}" \
+            --json mergeCommit -q '.mergeCommit.oid')
+
+          echo "Creating tag $VERSION at $MERGE_SHA"
+          gh api "repos/${{ github.repository }}/git/refs" \
+            -f ref="refs/tags/$VERSION" \
+            -f sha="$MERGE_SHA"