From 1e615acb3a0fe6435dcfcaf5683975d0a9e860ba Mon Sep 17 00:00:00 2001
From: Jade Guiton <jade.guiton@datadoghq.com>
Date: Wed, 27 Nov 2024 13:35:10 +0100
Subject: [PATCH] [chore] Add CI check to enforce merge freezes

---
 .github/workflows/check-merge-freeze.yml      | 23 +++++++++++++++++++
 .../workflows/scripts/check-merge-freeze.sh   | 11 +++++++++
 .../scripts/release-prepare-release.sh        |  3 ++-
 3 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/check-merge-freeze.yml
 create mode 100755 .github/workflows/scripts/check-merge-freeze.sh

diff --git a/.github/workflows/check-merge-freeze.yml b/.github/workflows/check-merge-freeze.yml
new file mode 100644
index 000000000000..da6215d6ae38
--- /dev/null
+++ b/.github/workflows/check-merge-freeze.yml
@@ -0,0 +1,23 @@
+name: Merge freeze
+
+on:
+  pull_request:
+    types: [opened, ready_for_review, synchronize, reopened, labeled, unlabeled]
+    branches: [main]
+  merge_group:
+    types: [checks_requested]
+
+jobs:
+  check-merge-freeze:
+    name: Check
+    # This condition is to avoid blocking the PR causing the freeze in the first place.
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'release:merge-freeze') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          sparse-checkout: .github/workflows/scripts
+      - run: ./.github/workflows/scripts/check-merge-freeze.sh
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: open-telemetry/opentelemetry-collector-contrib
\ No newline at end of file
diff --git a/.github/workflows/scripts/check-merge-freeze.sh b/.github/workflows/scripts/check-merge-freeze.sh
new file mode 100755
index 000000000000..efd8927b17d1
--- /dev/null
+++ b/.github/workflows/scripts/check-merge-freeze.sh
@@ -0,0 +1,11 @@
+#!/bin/bash -e
+#
+# Copyright The OpenTelemetry Authors
+# SPDX-License-Identifier: Apache-2.0
+
+BLOCKERS=$( gh pr list --search "label:release:merge-freeze" --json url --jq '.[].url' --repo "${REPO}" )
+if [ "${BLOCKERS}" != "" ]; then
+    echo "Merging in main is frozen, as there are open PRs labeled 'release:merge-freeze': ${BLOCKERS}"
+    echo "If you believe this is no longer true, re-run this job to unblock your PR."
+    exit 1
+fi
diff --git a/.github/workflows/scripts/release-prepare-release.sh b/.github/workflows/scripts/release-prepare-release.sh
index 4f6ebb155aec..3c4c0de598ff 100755
--- a/.github/workflows/scripts/release-prepare-release.sh
+++ b/.github/workflows/scripts/release-prepare-release.sh
@@ -64,7 +64,8 @@ make otelcontribcol
 
 git push origin "${BRANCH}"
 
-gh pr create --title "[chore] Prepare release ${CANDIDATE_BETA}" --body "
+# The `release:merge-freeze` label will cause the `check-merge-freeze` workflow to fail, enforcing the freeze.
+gh pr create --title "[chore] Prepare release ${CANDIDATE_BETA}" --label release:merge-freeze --body "
 The following commands were run to prepare this release:
 - make chlog-update VERSION=v${CANDIDATE_BETA}
 - sed -i.bak s/${CURRENT_BETA_ESCAPED}/${CANDIDATE_BETA}/g versions.yaml