docs: tell how to create a release branch for patch releases (#2329)

This adds some doc for how to create a branch when a patch release needs
to be based on the
original release and not from head.

---------

Co-authored-by: Ignas Anikevicius <[email protected]>

Author: rickeylev

DEVELOPING.md

@@ -24,6 +24,8 @@ Start from a clean checkout at `main`.
 Before running through the release it's good to run the build and the tests locally, and make sure CI is passing. You can
 also test-drive the commit in an existing Bazel workspace to sanity check functionality.
 
+### Releasing from HEAD
+
 #### Steps
 1. [Determine the next semantic version number](#determining-semantic-version)
 1. Create a tag and push, e.g. `git tag 0.5.0 upstream/main && git push upstream --tags`
@@ -42,9 +44,31 @@ To find if there were any features added or incompatible changes made, review
 the commit history. This can be done using github by going to the url:
 `https://github.com/bazelbuild/rules_python/compare/<VERSION>...main`.
 
+### Patch release with cherry picks
+
+If a patch release from head would contain changes that aren't appropriate for
+a patch release, then the patch release needs to be based on the original
+release tag and the patch changes cherry-picked into it.
+
+In this example, release `0.37.0` is being patched to create release `0.37.1`.
+The fix being included is commit `deadbeef`.
+
+1. `git checkout -b release/0.37 0.37.0`
+1. `git push upstream release/0.37`
+1. `git cherry-pick -x deadbeef`
+1. Fix merge conflicts, if any. If `MODULE.bazel.lock` conflicts occur, then
+   run `pre-commit run update-bzlmod-lockfiles -a`
+1. `git cherry-pick --continue` (if applicable)
+1. `git push upstream`
+
+If multiple commits need to be applied, repeat the `git cherry-pick` step for
+each.
+
+Once the release branch is in the desired state, use `git tag` to tag it, as
+done with a release from head. Release automation will do the rest.
+
 #### After release creation in Github
 
-1. Ping @philwo to get the new release added to mirror.bazel.build. See [this comment on issue #400](https://github.com/bazelbuild/rules_python/issues/400#issuecomment-779159530) for more context.
 1. Announce the release in the #python channel in the Bazel slack (bazelbuild.slack.com).
 
 ## Secrets