CI: Add backporting bot

.github/workflows/command-backport.yml

@@ -0,0 +1,42 @@
+name: Backport into stable
+
+on:
+  pull_request_target:
+    types: [closed]
+  issue_comment:
+    types: [created]
+permissions:
+  contents: write # so it can comment
+  pull-requests: write # so it can create pull requests
+jobs:
+  backport:
+    name: Backport pull request
+    runs-on: ubuntu-latest
+
+    # Excluding CI action user id `97796249`:
+    if: >
+      (
+        github.event_name == 'pull_request_target' &&
+        github.event.pull_request.merged
+      ) || (
+        github.event_name == 'issue_comment' &&
+        github.event.issue.pull_request &&
+        github.event.comment.user.id != 97796249 &&
+        (
+          startsWith(github.event.comment.body, '/backport')
+          || contains(toJson(github.event.comment.body), '\n/backport')
+        )
+      )
+    steps:
+      - uses: actions/checkout@v4
+      - name: Create backport pull requests
+        uses: korthout/backport-action@v3
+        with:
+          target_branches: stable2407
+          merge_commits: skip
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          label_pattern: "A4-needs-backport"
+          pull_description: |
+            Backport #${pull_number} into `${target_branch}` (cc @${pull_author}).
+          pull_title: |
+            [${target_branch}] Backport #${pull_number}

docs/BACKPORT.md

@@ -0,0 +1,31 @@
+# Backporting
+
+This document explains how to backport a merged PR from `master` to `stable`. Backports should only be used to fix bugs or security issues - never to introduce new features.
+
+## Steps
+
+1. Fix a bug through a PR that targets `master`.
+2. Add label `A4-needs-backport` to the PR.
+4. Merge the PR into `master`.
+5. Wait for the bot to open the backport PR.
+6. Ensure the change is audited or does not need audit.
+7. Merge the backport PR. 
+
+Alternatively to adding the label, you can also comment `/backport`. It should not be needed though, since the label can also be added after the PR is merged.
+
+## Example
+
+For example here where the dev triggered the process manually with a comment after the PR is merged:
+
+![backport](./.assets/backport-ex1.png)
+
+Or triggering the process with a label after merging:
+
+![backport](./.assets/backport-ex2.png)
+
+## Known Issue
+
+The bot has a bug and will always try to also backport the backport. It will make a comment in the backport that you can ignore.
+
+
+![backport](./.assets/backport-ex3.png)

docs/RELEASE.md

@@ -55,7 +55,7 @@ The Westend testnet will be updated to a new runtime every two weeks with the la
 
 **From `master` to `stable`**
 
-Backports in this direction can be anything that is audited and either a `minor` or a `patch` bump. [Security
+Backports in this direction can be anything that is audited and either a `minor` or a `patch` bump. See [BACKPORT.md](./BACKPORT.md) for more explanation. [Security
 fixes](#bug-and-security-fix) should be prioritized over additions or improvements. Crates that are declared as internal
 API can also have `major` version bumps through backports.
 
@@ -164,5 +164,6 @@ Describes how developers should merge bug and security fixes.
 2. The Pull Request is marked as priority fix.
 3. Audit happens with priority.
 4. It is merged into `master`.
-5. It is automatically back-ported to `stable`.
-6. The fix will be released in the next *Stable* release. In urgent cases, a release can happen earlier.
+5. Dev comments `/backport` or adds the `A4-needs-backport` label.
+6. It is automatically back-ported to `stable`.
+7. The fix will be released in the next *Stable* release. In urgent cases, a release can happen earlier.