i am all for having your ci ensuring the quality insurances which can be automated (firing unit tests, static code analysis, etc.) to reduce the amount of work any reviewer has to do on a pull request.

nevertheless, auto approving and merging pull requests and also auto bumping dependecies with only a bot as reviewer does sound like a very bad idea in general. how does one make sure the bump required for service A doesn't break service B which also relies that dependency? admitted, testing someone else's code is not the most exciting part of being a developer, but it's a necessary evil isn't it?

to be honest, this workflow sounds like hotfix hell to me when you'd combine it with continuous deployment...