How to Enforce Deployment Windows and Freezes From CI/CD

A deployment window (or freeze) blocks the deploy job outside allowed times or during a declared freeze.

Add a gate step that fails the deploy job when the current time is outside an allowed window or a freeze flag is set. This keeps deploys off Friday nights, holidays, or during an incident, without disabling the whole pipeline.

How it works

A small preflight step checks the clock (in a fixed timezone) and a freeze marker (a repository variable, a file in the repo, or an external flag). If either says "not now," the step exits non-zero and the deploy is skipped. Build and test jobs still run.

Block deploys outside the window and during a freeze

deploy:
  runs-on: ubuntu-latest
  steps:
    - name: Enforce deployment window and freeze
      run: |
        HOUR=$(TZ=America/New_York date +%H)
        DOW=$(TZ=America/New_York date +%u)   # 1=Mon .. 7=Sun
        if [ "${{ vars.DEPLOY_FREEZE }}" = "true" ]; then
          echo "Change freeze in effect"; exit 1
        fi
        if [ "$DOW" -ge 6 ] || [ "$HOUR" -lt 9 ] || [ "$HOUR" -ge 17 ]; then
          echo "Outside deploy window (Mon-Fri 09:00-17:00 ET)"; exit 1
        fi
    - run: ./deploy.sh --image myapp:${{ github.sha }}

Allow a documented override

For emergencies, honor a workflow_dispatch input like override_freeze: true so an on-call engineer can deploy a hotfix during a freeze. Log who overrode and why, and keep the override off automatic (push) triggers.

Related guides