Install, freeze, and let the hotfix through.

Quickstart

Install, make the check required, then freeze. This is the whole path from nothing to a branch that cannot be merged to, and every command below runs as written.

1. step 1 — install

   Start free — the first step of setup is the GitHub App install, where you pick the repositories Fwozen watches. It asks for eight repository and organisation permissions, and none of them can write to your code. The account permission is the other axis, granted by the person signing in rather than by the organisation. Sign-in requests the read:user and user:email scopes, and the App’s own account permission is one row, email addresses at read. Neither reaches a repository, and the address is only how Fwozen tells one person from another. Installing grants every permission Fwozen asks for, repository administration included. An installation made before Fwozen asked for it keeps its old set until an organisation owner approves, and some never will. The full inventory carries every row, including repository administration and where its rollout stands.

   The CLI is optional and separate. It needs Node 24 or newer, adds nothing to your shell profile, and checks a published sha256 before it writes anything:

   copy

   curl -fsSL https://fwozen.com/install | sh

   Read it before you run it — it is plain text at that URL. It verifies the sha256 of everything it downloads, and the same digest is published separately at https://fwozen.com/cli/release.json, so you can check the two agree before piping anything into a shell.

2. step 2 — make the check required

   Fwozen writes the current fwozen result to every relevant commit, then does one of two things. On an installation that has granted it repository administration: write, it writes the ruleset itself and reads it back from GitHub before saying it exists. Otherwise it opens GitHub’s Rules settings with the exact values to enter, you save one native rule, and Fwozen verifies it when you come back. /security says which installations have granted that. Either way the rule is the same object, and if you manage rules as code it is generated as gh api and Terraform:

   copy

   FWOZEN_APP_ID=$(curl -fsSL https://api.fwozen.com/.well-known/fwozen-app \
     | jq -r .githubAppId)
   
   gh api -X POST repos/acme/api-server/rulesets \
     -f name='fwozen' -f target='branch' \
     -f enforcement='active' \
     -F conditions[ref_name][include][]='refs/heads/main' \
     -F rules[][type]='required_status_checks' \
     -F 'rules[][parameters][required_status_checks][][context]=fwozen' \
     -F "rules[][parameters][required_status_checks][][integration_id]=$FWOZEN_APP_ID"

   The integration_id pins the required check to Fwozen’s GitHub App. Without it any app can satisfy the check, and Fwozen reports the branch as needing attention rather than verified.

3. step 3 — get a key

   Only if you are freezing from a script. In the dashboard, the quick-freeze band on the freezes tab is one click and needs no key at all. Settings → API keys → Create key → tick freeze:write for the command below, or freeze:read for a deploy gate → copy the secret, which is shown once. Then export FWOZEN_TOKEN=fwz_live_…. Minting a key needs the owner or admin role.

4. step 4 — freeze

   copy

   curl -X POST https://api.fwozen.com/v1/freezes \
     -H "Authorization: Bearer $FWOZEN_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"scope":{"kind":"org"},
         "reason":"Testing Fwozen",
         "durationMinutes":2,
         "impactAcknowledged":true}'

   Two fields carry their weight there. Content-Type is required because curl -d declares a form body on its own. impactAcknowledged is how an org-wide freeze says it accepts an uncalculated blast radius; send previewedRepoCount from POST /v1/scope/preview instead to record the number you actually saw. Either way it is in the audit log, and neither changes what gets frozen. A single-branch freeze needs neither.

5. step 5 — check a pull request

   Open any pull request in scope. The fwozen check is failing with your reason on it, and the merge button is disabled. In two minutes it lifts itself.