Automatically Backport Security Fixes

.github/PULL_REQUEST_TEMPLATE/security_fix.md

@@ -0,0 +1,38 @@
+<!--
+Please rename the PR to follow the following convention:
+PR Title: "Security Fix: <Short Description of Changes>"
+
+Please add the "security" label to the PR.
+-->
+
+## Security Fix
+
+### Severity
+
+- [ ] Critical
+- [ ] High
+- [ ] Medium
+- [ ] Low
+
+### Description
+
+A clear description of the security issue being addressed.
+
+### Root Cause
+
+Brief explanation of what caused the security issue.
+
+### Link to Security Notice
+
+Link to CVE/GHAS notice.
+
+### Solution
+
+Describe the fix implemented and why this approach was chosen.
+
+### Additional Notes
+
+Any additional context or considerations for reviewers.
+
+---
+<!-- This PR will be automatically backported to supported release branches via Mergify due to the "security" label -->

.github/mergify.yml

@@ -1,4 +1,9 @@
 # Configuration file for mergify
+
+# Branch variables for backport targets
+latestMinor: &latestMinor "release/5.2.x"
+previousMajor: &previousMajor "release/4.11.x"
+
 defaults:
   actions:
     backport:
@@ -27,3 +32,15 @@ pull_request_rules:
         message: |
           This pull request is now in conflicts. Could you fix it @{{author}}? 🙏
           To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/
+
+  - name: Automatic backport for Security fixes
+    conditions:
+      - and:
+          - merged
+          - base=master
+          - label="security"
+    actions:
+      backport:
+        branches:
+          - *latestMinor
+          - *previousMajor

common/config/azure-pipelines/jobs/version-bump.yaml

@@ -113,6 +113,10 @@ jobs:
           # manually to be the most recent previous major release
           # e.g. if this release is `release/5.0.x`, value in `gather-docs.yaml`
           # should be `release/4.<whatever_last_minor_release_version_was>.x`
+          # additionally if major version bump, the `mergify.yml` also needs to be edited manually
+          # if this release is `release/5.0.x`,change the `latestMinor` variable to `release/5.0.x`
+          # and the `previousMajor` variable to `release/4.<whatever_last_minor_release_version_was>.x`
+
           if [ $((previousMinorVersion)) -lt 0 ]
           then
             echo "This is is a major release. Edit \"gather-docs.yaml\" manually."
@@ -254,8 +258,22 @@ jobs:
         displayName: Get new version number
         name: getVersion
 
-      # When creating a minor release, the NextVersion.md need to be cleared and the contents placed into a {Version Number}.md file
       - ${{ if eq(parameters.BumpType, 'minor') }}:
+
+          # When creating a minor release, the mergify.yml file needs to be updated to change the "latestMinor" branch for security fixes
+          - bash: |
+              mergifyPath=".github/mergify.yml"
+              version=$(echo $(getVersion.version) | sed 's/\([0-9]*\.[0-9]*\)\.[0-9]*/\1.x/')
+              releaseBranch="release/$version"
+              echo "Updating mergify.yml to use $releaseBranch as the recent minor branch for security fixes"
+
+              # Update the latestMinor variable in mergify.yml
+              sed -i "s|^latestMinor: \&latestMinor \"release/[0-9]*\.[0-9]*\.x\"$|latestMinor: \&latestMinor \"$releaseBranch\"|" "$mergifyPath"
+
+            displayName: Update mergify.yml for new minor release
+            condition: and(succeeded(), startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'))
+
+          # When creating a minor release, the NextVersion.md need to be cleared and the contents placed into a {Version Number}.md file
           - powershell: |
               $sourceFile = 'docs/changehistory/NextVersion.md'