Change freezes as an API.

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Change freeze gate
        env:
          CF_KEY: ${{ secrets.CHANGEFREEZE_KEY }}
          EXCEPTION_TOKEN: ${{ inputs.exception_token }}
        run: |
          curl -sf -X POST https://changefreeze.io/v1/check \
            -H "Authorization: Bearer $CF_KEY" -H "Content-Type: application/json" \
            -d "{\"service\":\"checkout-api\",\"environment\":\"prod\",\"change_type\":\"code\",
                 \"actor\":\"${{ github.actor }}\",\"source\":\"github-actions\",
                 \"ref\":\"${{ github.repository }}@${{ github.sha }}\",
                 \"exception_token\":\"$EXCEPTION_TOKEN\"}" \
            || { echo "::error::Change freeze is active. Request an exception in ChangeFreeze."; exit 1; }
      - run: ./deploy.sh

deploy_prod:
  stage: deploy
  environment: production
  before_script:
    - |
      curl -sf -X POST https://changefreeze.io/v1/check \
        -H "Authorization: Bearer $CHANGEFREEZE_KEY" -H "Content-Type: application/json" \
        -d "{\"service\":\"$CI_PROJECT_NAME\",\"environment\":\"prod\",\"change_type\":\"code\",
             \"actor\":\"$GITLAB_USER_EMAIL\",\"source\":\"gitlab-ci\",\"ref\":\"$CI_PIPELINE_URL\",
             \"exception_token\":\"${EXCEPTION_TOKEN:-}\"}" \
        || { echo "Change freeze is active"; exit 1; }
  script:
    - ./deploy.sh

#!/usr/bin/env bash
set -euo pipefail
res=$(curl -s -o /tmp/cf.json -w '%{http_code}' -X POST https://changefreeze.io/v1/check \
  -H "Authorization: Bearer $CF_KEY" -H "Content-Type: application/json" \
  -d "{\"service\":\"$SERVICE\",\"environment\":\"$ENV\",\"change_type\":\"infra\",
       \"actor\":\"$(whoami)@$(hostname)\",\"source\":\"deploy.sh\",\"exception_token\":\"${EXCEPTION_TOKEN:-}\"}")
case "$res" in
  200) ;;                                            # allow, warn or override
  423) echo "BLOCKED: $(jq -r .message /tmp/cf.json)"; exit 2 ;;
  *)   echo "ChangeFreeze returned $res"; exit 3 ;;   # fail closed on errors
esac

data "http" "freeze" {
  url             = "https://changefreeze.io/v1/status?service=payments-db&environment=prod&change_type=infra"
  request_headers = { Authorization = "Bearer ${var.changefreeze_key}" }
}

locals { freeze = jsondecode(data.http.freeze.response_body) }

resource "aws_db_instance" "payments" {
  # ...
  lifecycle {
    precondition {
      condition     = local.freeze.decision != "block"
      error_message = "Change freeze active: ${local.freeze.message}"
    }
  }
}

apiVersion: batch/v1
kind: CronJob
metadata: { name: nightly-etl }
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          initContainers:
            - name: change-freeze-gate
              image: curlimages/curl:8.10.1
              env:
                - { name: CF_KEY, valueFrom: { secretKeyRef: { name: changefreeze, key: api-key } } }
              command: ["sh", "-c"]
              args:
                - |
                  curl -sf -X POST https://changefreeze.io/v1/check \
                    -H "Authorization: Bearer $CF_KEY" -H "Content-Type: application/json" \
                    -d '{"service":"nightly-etl","environment":"prod","change_type":"data","source":"k8s-cronjob"}'
          containers:
            - { name: etl, image: ghcr.io/acme/etl:1.42 }
          restartPolicy: Never