code-freeze.yml

name: Code Freeze

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

env:
  FROZEN: ${{ vars.FROZEN }}
  UNFROZEN_PREFIX: ${{ vars.UNFROZEN_PREFIX }}

jobs:
  check-pr-frozen-status:
    runs-on: ubuntu-latest
    steps:
    - name: Fetch PR data and check if merge allowed
      if: env.FROZEN == 'true'
      env:
        PR_TITLE: ${{ github.event.pull_request.title }}
        BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
      run: |
        # if it's not a critical fix
        if ! [[ "$PR_TITLE" == fix(critical):* ]]; then
          # and there's an unfrozen prefix
          if [[ -n "${UNFROZEN_PREFIX:-}" ]]; then
            # check if the branch matches unfrozen prefix
            if [[ "$BRANCH_NAME" != $UNFROZEN_PREFIX* ]]; then
              echo "Error: You can only merge from branches that start with '$UNFROZEN_PREFIX', or PRs titled with prefix 'fix(critical): '."
              exit 1
            fi
          # repo is fully frozen
          else
            echo "Error: You can only merge PRs titled with prefix 'fix(critical): '."
            exit 1
          fi
        fi