Safeguards on risky changes

Some changes need more than a yes, so Firefight now adds a safeguard around them, shown on the confirmation before you approve. See Halon's safe changes.

Changes to rows. Before an UPDATE, DELETE or INSERT through a connected database, Firefight counts the rows it would touch and shows a few of them. Right before it runs, it counts again and stops if the number moved, then keeps a copy of the rows as they were, which you can download for 30 days.

Temporary changes. A change your customers feel for a while, such as turning a feature flag off, adding a Cloudflare block or pausing a service, is undone after an hour by default. Pick another time or Never under Undo automatically. Firefight reminds you before the time is up, with Keep it, One more hour and Undo now.

Someone else's run. Before Halon cancels a CI run someone else started, that person is asked in Slack with Agree and Say no, and the run is cancelled only once they agree.