doc: mention where to push security commits

nodejs · Sep 19, 2022 · 2016058 · 2016058
1 parent 8b50160
commit 2016058
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/doc/contributing/releases.md b/doc/contributing/releases.md
@@ -249,6 +249,15 @@ each commit from the PR. You will also need to manually apply the PR
 metadata (`PR-URL`, `Reviewed-by`, etc.) by amending the commit messages. If
 known, additionally include `CVE-ID: CVE-XXXX-XXXXX` in the commit metadata.
 
+Push the commits to the `vN.x.x-proposal` branch that has branched off of
+`vN.x`.
+
+```console
+git checkout vN.x
+git checkout -b vN.x.x-proposal
+git cherry-pick  ...  # cherry-pick nodejs-private PR commits directly into the proposal
+```
+
 **Note**: Do not run CI on the PRs in `nodejs-private` until CI is locked down.
 You can integrate the PRs into the proposal without running full CI.