ci: add check for release branches

If release branch, CI now checks that all commits are either
cherry-picked from master (using `-x` option) or contain [NO MASTER].

ci/check_release_commit_messages.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+fail=0
+
+# list all commits between HEAD and master
+for commit in $(git rev-list origin/master..)
+do
+    message=$(git log -n1 --format=%B $commit)
+    echo "Checking $commit"
+
+    # The commit message must contain either
+    # 1. "cherry-picked from [some commit in master]"
+    if [[ $message =~ "(cherry picked from commit" ]]; then
+    	# remove last ")" and extract commit hash
+      master_commit=$(echo ${message:0:-1} | tr ' ' '\n' | tail -1)
+      # check if master really contains this commit hash
+      if [[ $(git branch -a --contains $master_commit | grep --only-matching master) == "master" ]]; then
+        continue
+      fi
+    fi
+
+    # 2. [NO MASTER] substring
+    if [[ $message =~ "[NO MASTER]" ]]; then
+      continue
+    fi
+
+    fail=1
+    echo "FAILURE! Neither 'cherry picked from..' nor '[NO MASTER]' substring found in this commit message."
+done
+
+exit $fail

ci/prebuild.yml

@@ -34,3 +34,10 @@ gen prebuild:
       - "**/*.pyi"
   script:
     - pipenv run make gen_check
+
+release commit messages prebuild:
+  stage: prebuild
+  only:
+    - /^release\//
+  script:
+    - ci/check_release_commit_messages.sh