ci: fix version-bump-pr permissions

.github/workflows/dependabot.yml

@@ -19,6 +19,6 @@ jobs:
       pull-requests: write
     steps:
       - name: Auto approve Dependabot PR
-        uses: secure-software-engineering/actions/dependabot@6856b8183bba81fce20d9052b9aa6f3e20823b36 # develop
+        uses: secure-software-engineering/actions/dependabot@7458a0f725752b2bf928c2f9e42c818b6abad742 # develop
         with:
           token: ${{ secrets.AUTO_MERGE_PAT }}

.github/workflows/release-publish.yml

@@ -133,6 +133,9 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      # GITHUB_TOKEN approves the bump PR below. The PR is authored by the
+      # AUTO_MERGE_PAT owner, who cannot approve their own PR.
+      pull-requests: write
     steps:
       - name: Checkout master
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -149,6 +152,7 @@ jobs:
           cache: 'maven'
 
       - name: Bump to next SNAPSHOT and open auto-merge PR
+        id: bump
         env:
           GH_TOKEN: ${{ secrets.AUTO_MERGE_PAT }}
           ACTOR: ${{ github.actor }}
@@ -185,3 +189,20 @@ jobs:
           fi
 
           gh pr merge "$PR_NUMBER" --auto --merge
+          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+
+      - name: Approve next-SNAPSHOT PR as github-actions[bot]
+        # The PR is opened with AUTO_MERGE_PAT, so its owner is the PR author and
+        # GitHub won't let them approve it - branch protection requiring a review
+        # would block the auto-merge forever. Approving with GITHUB_TOKEN counts as
+        # a review by a different actor (github-actions[bot]).
+        # Requires the repo/org setting "Allow GitHub Actions to create and approve
+        # pull requests" (Settings -> Actions -> General -> Workflow permissions).
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ steps.bump.outputs.pr_number }}
+          RELEASE_TAG_NAME: ${{ needs.release.outputs.tag_name }}
+        run: |
+          set -euo pipefail
+          gh pr review "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --approve \
+            -b "Automated SNAPSHOT bump following ${RELEASE_TAG_NAME}."

.github/workflows/release-schedule.yml

@@ -12,7 +12,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    uses: secure-software-engineering/actions/.github/workflows/maven-release-schedule.yml@6856b8183bba81fce20d9052b9aa6f3e20823b36 # develop
+    uses: secure-software-engineering/actions/.github/workflows/maven-release-schedule.yml@7458a0f725752b2bf928c2f9e42c818b6abad742 # develop
     with:
       head_branch: master
       java_version: '21'

.github/workflows/release-title-sync.yml

@@ -20,7 +20,7 @@ jobs:
       startsWith(github.head_ref, 'release/prep-') &&
       github.event.pull_request.head.repo.full_name == github.repository
     # Reusable workflow: secure-software-engineering/actions/release/README.md
-    uses: secure-software-engineering/actions/.github/workflows/maven-release-title-sync.yml@6856b8183bba81fce20d9052b9aa6f3e20823b36 # develop
+    uses: secure-software-engineering/actions/.github/workflows/maven-release-title-sync.yml@7458a0f725752b2bf928c2f9e42c818b6abad742 # develop
     with:
       java_version: '21'
       tag_pattern: 'V{major}.{minor}.{patch}'

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
   prepare-release:
     name: Open release PR against master
     # Reusable workflow: secure-software-engineering/actions/release/README.md
-    uses: secure-software-engineering/actions/.github/workflows/maven-release-prepare.yml@6856b8183bba81fce20d9052b9aa6f3e20823b36 # develop
+    uses: secure-software-engineering/actions/.github/workflows/maven-release-prepare.yml@7458a0f725752b2bf928c2f9e42c818b6abad742 # develop
     with:
       release_type: ${{ inputs.release_type }}
       head_branch: master

.github/workflows/style.yml

@@ -11,7 +11,7 @@ permissions:
 jobs:
   check-formatting:
     # Reusable workflow: secure-software-engineering/actions/.github/workflows/maven-style-check.yml
-    uses: secure-software-engineering/actions/.github/workflows/maven-style-check.yml@6856b8183bba81fce20d9052b9aa6f3e20823b36 # develop
+    uses: secure-software-engineering/actions/.github/workflows/maven-style-check.yml@7458a0f725752b2bf928c2f9e42c818b6abad742 # develop
     with:
       java_version: '21'
       java_distribution: adopt