Don't allow Friday deploys in Chrome. (#4513)

This was requested by Chrome in b/384493595.
With more team members joining, I think it's best to enforce this
policy, than expect everyone to know it.

src/local/butler/deploy.py

@@ -23,6 +23,8 @@
 import tempfile
 import time
 
+import pytz
+
 from local.butler import appengine
 from local.butler import common
 from local.butler import constants
@@ -47,9 +49,9 @@
 Version = namedtuple('Version', ['id', 'deploy_time', 'traffic_split'])
 
 
-def now():
+def now(tz=None):
   """Used for mocks."""
-  return datetime.datetime.now()
+  return datetime.datetime.now(tz)
 
 
 def _get_services(paths):
@@ -449,6 +451,27 @@ def _deploy_terraform(config_dir):
   common.execute(f'rm -rf {terraform_dir}/.terraform*')
 
 
+def _is_safe_deploy_day():
+  time_now_in_ny = now(pytz.timezone('America/New_York'))
+  day_now_in_ny = time_now_in_ny.weekday()
+  return day_now_in_ny not in {4, 5, 6}  # The days of the week are 0-indexed.
+
+
+def _enforce_safe_day_to_deploy():
+  """Checks that is not an unsafe day (Friday, Saturday, or Sunday) to
+  deploy for chrome ClusterFuzz."""
+
+  config = local_config.Config()
+  if config.get('weekend_deploy_allowed', True):
+    return
+
+  if not _is_safe_deploy_day():
+    raise RuntimeError('Cannot deploy Fri-Sun to this CF instance except for '
+                       'urgent fixes. See b/384493595. If needed, temporarily '
+                       'delete+commit this. You are not too l33t for this '
+                       'rule. Do not break it!')
+
+
 def _deploy_k8s(config_dir):
   """Deploys all k8s workloads."""
   k8s_dir = os.path.join('infra', 'k8s')
@@ -498,6 +521,8 @@ def execute(args):
     print('gsutil not found in PATH.')
     sys.exit(1)
 
+  _enforce_safe_day_to_deploy()
+
   # Build templates before deployment.
   appengine.build_templates()