How to Enforce Deployment Freeze Windows in CI

A time check at the top of the deploy job lets you enforce blackout windows (weekends, end of quarter) as a real, auditable gate.

Change-freeze windows are a common control around high-risk periods. Encode the schedule in CI so releases are blocked automatically rather than by reminder. This page shows a simple time gate; it is educational guidance you can extend.

Steps

• Define the freeze rules (days or date ranges when deploys are blocked).
• Check the current UTC time at the start of the deploy job.
• Fail the job with a clear message when inside a freeze, allowing a documented override.

Freeze gate

- name: Enforce change freeze
  run: |
    DOW=$(date -u +%u)      # 6=Sat, 7=Sun
    if [ "$DOW" -ge 6 ] && [ "${{ github.event.inputs.override }}" != "true" ]; then
      echo "Weekend change freeze in effect. Use an approved override."; exit 1
    fi
    # Hard blackout date range
    TODAY=$(date -u +%Y-%m-%d)
    if [[ "$TODAY" > "2026-12-20" && "$TODAY" < "2027-01-03" ]]; then
      echo "Year-end freeze in effect."; exit 1
    fi

Notes

• Gate the override input behind a protected environment so it needs approval.
• Log every override with the actor so exceptions are auditable.

Related guides