Add a workflow for automated backporting

1. Find the latest release branch
1. For each commit in main and not in release branch (compared by
   title), find the corresponding PR.
1. If the PR fixes an issue labeled "bug", and neither the PR nor the
   issue are labeled "no-backport", cherry-pick the commits from the PR
onto the release branch, and create a PR with these changes.

.github/workflows/backport.yaml

@@ -0,0 +1,38 @@
+name: Backport Bug Fixes
+on:
+  schedule:
+    # Run weekdays 12:00 on main branch, so that it doesn't wreak havoc on
+    # weekends.
+    - cron: '0 12 * * 1-5'
+  workflow_dispatch:
+  push:
+    branches:
+      # You can run and debug new versions of the backport script by pushing it
+      # to this branch. workflow_dispatch can only be run through github cli for
+      # branches that are not main, so it's inconvenient.
+      - backport/trigger
+
+jobs:
+  backport:
+    name: Backport Bug Fixes
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Install Linux Dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install pip
+
+      - name: Install Python Dependencies
+        run: |
+          pip install PyGithub requests
+
+      - name: Checkout TimescaleDB
+        uses: actions/checkout@v3
+
+      - name: Run the Backport Script
+        env:
+          GITHUB_TOKEN: ${{ secrets.ORG_AUTOMATION_TOKEN }}
+        run: |
+          git remote --verbose
+          scripts/backport.py

.github/workflows/changelog-check.yaml

@@ -2,7 +2,10 @@ name: Check CHANGELOG.md updated
 "on":
   pull_request:
     types: [opened, synchronize, reopened, edited]
-    branches: [main]
+    # It's important to check that the changelog is updated with bug fixes that
+    # we backport to the release branches, so these branches are included as
+    # well.
+    branches: [main, "[0-9]+.[0-9]+.x"]
 jobs:
   # Check that the CHANGELOG is updated by the pull request. This can be
   # disabled by adding a trailer line of the following form to the

.github/workflows/code_style.yaml

@@ -85,7 +85,7 @@ jobs:
           pip install --upgrade pip
           # Inexplicably, at some point pip started to insist on installing
           # prospector==1.7.7, which is incompatible with the new pylint.
-          pip install black prospector==1.8.4 psutil pylint
+          pip install black prospector==1.8.4 psutil pylint pygithub
           pip list
           pip list --user
       - name: Checkout source

.pull-review

@@ -57,10 +57,13 @@ reviewers:
 review_blacklist:
   - horzsolt
 
-# ignore changes to the test output files. 
+# ignore changes to the test output files.
 # 1. because they usually will have equivalent .sql files
 # 2. because people that modify a test, don't necessarily change the same c-functionality at all
 # so tests should be less important than C files
 file_blacklist:
   - tsl/test/expected/*.out
   - test/expected/*.out
+
+label_blacklist:
+  - pr-backport