Gating deploys

Your pipeline enforces a requested deployment freeze by asking Fwozen, through the fwozen/gate-action step or an endpoint any pipeline can poll. The gate refuses the deploy when your workflow calls it. Fwozen does not reach into GitHub and stop a deployment on its own, and this is not GitHub’s native deployment protection rules, which need Enterprise for private repositories. The trade is that it works on every GitHub plan, and the cost is that a deploy job which never calls the gate is never gated.

- uses: fwozen/gate-action@v1
  with:
    token: ${{ secrets.FWOZEN_TOKEN }}

Put it as the first step of every deploy job. A job without it is not gated. The gate fails closed: a timeout, a non-2xx, or a missing Fwozen-Frozen header all count as frozen. A deploy gate that fails open is not a gate.

secrets.FWOZEN_TOKEN is an API key with the freeze:read scope. Create it at Settings → API keys → Create key in the dashboard, copy the secret, which is shown once, and paste it into the repository or organisation secret of that name. Outside GitHub Actions, poll the same endpoint from any CI system:

curl -s https://api.fwozen.com/v1/freeze-state?repo=acme/api-server \
  -H "Authorization: Bearer $FWOZEN_TOKEN"
# => Fwozen-Frozen: true  (header — the deploy decision)
# => { "frozen": true, "allowDeployments": false, "reason": "4.2 release cut",
#      "endsAt": "2026-08-01T09:00:00Z" }

The fwozen/gate-action step and GET /v1/freeze-state run on every plan, Free included. What starts at Team, $29/mo, is fwozen/deploy-gate, the second required check you switch on per branch so a pull request shows the deploy verdict too. There is no per-environment gating yet: the answer is per repository and branch, so a pipeline that deploys two environments from one branch gets the same verdict for both.