Freeze
The dividing line between auto-fixable changes and locked review.
Deprecated. The freeze step is replaced by apply-patch: true on individual steps. Existing workflows using
freeze continue to work. See apply-patch for the recommended
approach.
The freeze step is a dividing line in your workflow. It separates steps that can auto-fix your code from steps that must leave the code untouched.
Recommended Alternative: apply-patch
Instead of a separate freeze step, add apply-patch: true to steps that produce patches:
- name: lint
uses: airlock-hq/airlock/defaults/lint@main
apply-patch: true # Auto-commit lint fixes after this stepThis is more granular than freeze — each step controls whether its patches are committed immediately.
How Freeze Works (Legacy)
Add freeze to your workflow with:
- name: freeze
run: airlock exec freezeWhen this step runs, it:
- Commits any pending changes from previous steps (linter auto-fixes, formatter patches)
- Locks the worktree — no more direct file modifications allowed
- Sets the
AIRLOCK_FROZENenvironment variable totruefor all subsequent steps
Pre-Freeze Steps
Steps before freeze can modify files freely. This is where you run linters and formatters that auto-fix issues:
steps:
- name: lint
uses: airlock-hq/airlock/defaults/lint@main # Can modify files
- name: freeze
run: airlock exec freezePatches from pre-freeze steps are applied directly to the worktree and committed as part of the freeze.
Post-Freeze Steps
Steps after freeze cannot modify the worktree directly. If a post-freeze step produces file changes, those changes are captured as patches and queued for review in the Push Request's Patches tab.
- name: freeze
run: airlock exec freeze
- name: test
uses: airlock-hq/airlock/defaults/test@main # Worktree is locked
- name: push
uses: airlock-hq/airlock/defaults/push@main
require-approval: true # Pauses for human approvalThis ensures no surprise mutations happen after the code has been reviewed.
The AIRLOCK_FROZEN Environment Variable
After freeze runs, AIRLOCK_FROZEN=true is available to all subsequent steps. Custom steps can check this variable to adjust their behavior:
if [ "$AIRLOCK_FROZEN" = "true" ]; then
echo "Worktree is frozen — running in read-only mode"
fi