You can use the CVSROOT/commitinfo file to run scripts before any commits to CVS projects matching a regular expression. I used this to make a CVS project read-only after moving it into Git.