[ML] Add auto-backport label for automatic backport PR merging

[edsavage]

Summary

Adds an auto-backport label that controls whether backport PRs are automatically merged after CI passes. This builds on PR #2940 (label copying and backport-pending tracking).

How it works

Without auto-backport label (default): Backport PRs are created as before, requiring manual review and merge.

With auto-backport label on the original PR:

1. Backport PRs are created normally by sorenlouv/backport-github-action
2. The Enable auto-merge on backport PRs step parses the created PR numbers from the backport log and enables GitHub auto-merge (squash) on each one
3. The new auto-approve-backports.yml workflow auto-approves backport PRs that:
   • Are opened by github-actions[bot]
   • Have a branch name starting with backport/
   • Originate from a source PR that has the auto-backport label
4. Once CI passes and the approval is in place, GitHub auto-merges the backport PR
5. When all backport PRs are merged, the backport-pending label is removed from the original PR (from PR [ML] Improve backport automation with label copying and pending tracking #2940)

Prerequisites

Auto-merge must be enabled in the repo settings (Settings > General > Allow auto-merge). Currently it is disabled (allow_auto_merge: false). A repo admin needs to toggle this on. Without it, the gh pr merge --auto step will emit a warning but not fail the workflow.

Label

Created the auto-backport label on the repo (color #692F45, matching elasticsearch's label).

Comparison with other elastic repos

Repo	Approach
Kibana	autoMerge: true in .backportrc.json + auto-approve-backports.yml
Connectors	auto-backport label triggers auto-merge via workflow inputs
Elasticsearch	auto-backport label exists but backport handled by external infra
ml-cpp (this PR)	auto-backport label on original PR → auto-merge + auto-approve on backport PRs

Test plan

Note: requires a repo admin to enable auto-merge first.

• Merge a PR without auto-backport — verify backport PRs are created but NOT auto-merged
• Merge a PR with auto-backport — verify backport PRs get auto-merge enabled and auto-approved
• Verify backport PRs auto-merge after CI passes
• Verify backport-pending is removed from the original PR after all backports merge

Made with Cursor

[prodsecmachine]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.