chore: import upstream snapshot with attribution

.github/workflows/Approval.yml

@@ -0,0 +1,53 @@
+name: Approval
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+env:
+  BRANCH: ${{ github.base_ref }}
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  PR_ID: ${{ github.event.pull_request.number }}
+  COMMIT_ID: ${{ github.event.pull_request.head.sha }}
+  token: ${{ vars.ACTION_GITHUB_TOKEN }}
+
+jobs:
+  check-bypass:
+    name: Check bypass
+    if: ${{ github.repository_owner == 'PaddlePaddle' }}
+    uses: ./.github/workflows/check-bypass.yml
+    with:
+      workflow-name: 'approval'
+    secrets:
+      github-token: ${{ secrets.GITHUB_TOKEN }}
+
+  check-approvers:
+    name: Check approval
+    needs: [check-bypass]
+    if: ${{ needs.check-bypass.outputs.can-skip != 'true' }}
+    runs-on:
+      group: APPROVAL
+    timeout-minutes: 10
+    steps:
+      - name: Cleanup
+        run: |
+          rm -rf * .[^.]*
+      - name: Checkout Repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 200
+
+      - name: Update paddle
+        run: |
+          git switch -c test
+          git remote add upstream https://github.com/PaddlePaddle/Paddle.git
+          git fetch upstream $BRANCH
+          git checkout $BRANCH
+          git config --global user.name "PaddleCI"
+          git config --global user.email "paddle_ci@example.com"
+          git merge test
+
+      - name: Display Required Approvers
+        run: |
+          bash ci/check_approval.sh