From b650eb6e4f7d37e8a71e0b2f208fabe53b1ef968 Mon Sep 17 00:00:00 2001
From: simon <simon.faltum@databricks.com>
Date: Thu, 4 Jun 2026 15:10:27 +0200
Subject: [PATCH] ci: add code-freeze check to block non-sync-bot PRs

This repo is becoming a read-only mirror fed one-way by the databricks-ci-ghec GitHub Apps. The code-freeze workflow fails any PR not authored by databricks-ci-ghec-1[bot] or databricks-ci-ghec-2[bot], and passes for the sync bots.

It only hard-blocks once added as a required status check on the main ruleset; both sync apps are already bypass actors there, so their syncs are unaffected.

Co-authored-by: Isaac
Signed-off-by: simon <simon.faltum@databricks.com>
---
 .github/workflows/code-freeze.yml | 37 +++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 .github/workflows/code-freeze.yml

diff --git a/.github/workflows/code-freeze.yml b/.github/workflows/code-freeze.yml
new file mode 100644
index 0000000..8d68f91
--- /dev/null
+++ b/.github/workflows/code-freeze.yml
@@ -0,0 +1,37 @@
+name: Code Freeze
+
+# This repository is a read-only mirror. Its contents are synced one-way by an
+# internal Databricks GitHub App. Direct pull requests are not accepted.
+#
+# This check only reports pass/fail. It blocks merges only once it is added as a
+# required status check on the `main` ruleset. The sync apps are bypass actors
+# on that ruleset, so their automated syncs are unaffected.
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+  merge_group:
+
+permissions: {}
+
+jobs:
+  code-freeze:
+    name: code-freeze
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+    steps:
+      - name: Reject pull requests not from the sync bots
+        if: github.event_name == 'pull_request'
+        env:
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+        run: |
+          case "$PR_AUTHOR" in
+            'databricks-ci-ghec-1[bot]' | 'databricks-ci-ghec-2[bot]')
+              echo "Author '$PR_AUTHOR' is a sync bot. Allowing."
+              exit 0
+              ;;
+          esac
+          echo "::error::This repository is a read-only mirror and is frozen."
+          echo "::error::Direct pull requests are not accepted."
+          exit 1