Looking into this, it looks like the main steps required to achieve this would be:

Update the renovate config to create a auto-merge-trusted-deps package group rule that sets ciliumbot as requested reviewer (similar to Add auto-merge for renovate for trusted dependencies cilium#33287)
Create an auto-approve github action workflow (similar to renovate: add auto-approve bot for renovate PRs cilium#33604)
Make sure GHA workflows running in cilium/image-tools have access to a AUTO_APPROVE_TOKEN secret that has the proper required permissions to approve PRs and manage reviewers on PRs in cilium/image-tools
Update cilium/image-tools repository settings to allow renovate to merge (or automerge) PRs:

let Renovate bypass the mandatory Pull Request reviews using the "Allow specified actors to bypass required pull requests" option in your branch protection rules.

Open questions:

It looks like cilium/cilium runs the self-hosted version of renovate as the cilium-renovate[bot] github bot user while cilium/image-tools currently runs the mend-hosted version as renovate[bot]. Is this difference an issue in the context of enabling renovate PRs auto-approval?

Automate renovate PRs #335

Description