ci: code freeze through github actions

.github/code-freeze-filter.yaml

@@ -0,0 +1,14 @@
+# Each component that is being frozen should have a section in this file.
+# The `changed` section should pull all the files that are changed
+# in order to put an error on the given file if it is changed.
+
+# Please provide a reasoning for each component that is frozen.
+
+# Conductor is frozen for zellic audit.
+conductor: &conductor
+  - crates/astria-conductor/src/**
+sequencer-relayer: &sequencer-relayer
+  - crates/astria-sequencer-relayer/src/**
+changed:
+  - *conductor
+  - *sequencer-relayer

.github/workflows/code-freeze.yml

@@ -0,0 +1,38 @@
+on:
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
+      - unlabeled
+    branches:
+      - main
+
+jobs:
+  code_freeze:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Filter Check
+        id: filters
+        uses: dorny/paths-filter@v3
+        with:
+          list-files: shell
+          filters: .github/code-freeze-filter.yaml
+      - name: Code Freeze
+        if: steps.filters.outputs.changes != '' && !contains(github.event.pull_request.labels.*.name, 'override-freeze')
+        run: |
+          TITLE="Code Freeze in Effect"
+          LEGIBLE_CHANGES=$(echo "${{ steps.filters.outputs.changes }}" | sed 's/,/, /g')
+          MESSAGE=("This PR updates the following components which are code frozen:"
+                   "$LEGIBLE_CHANGES"
+                   "Freeze can be overriden by adding the 'override-freeze' label to the PR."
+                   )
+          echo "::error title=$TITLE::${MESSAGE[*]}"
+          IFS="," read -ra FILE_LIST <<< "${{ steps.filters.outputs.changes }}"
+          FILE_MESSAGE="This file is under code freeze."
+          for FILE in "${FILE_LIST[@]}"; do
+            echo "::error file=$FILE,title=$TITLE::$FILE_MESSAGE"
+          done
+          exit 1