How do you handle maintenance window for DDL commands on Primary replicating to readable secondary AGs
disable read on secondary:
USE [master]
GO
LTER AVAILABILITY GROUP [AG-Something]
MODIFY REPLICA ON N'SQLSERVER-SECONDARY' WITH (SECONDARY_ROLE(ALLOW_CONNECTIONS =  NO))
GO

do your ddll workload on primary

re enable read on secondary
USE [master]
GO
ALTER AVAILABILITY GROUP [AG-Something]
MODIFY REPLICA ON N'SQLSERVER-SECONDARY' WITH (SECONDARY_ROLE(ALLOW_CONNECTIONS =  READ_ONLY))
GO


you can chek the AG status between the step 2 and 3 with this query:
SELECT 
ar.replica_server_name, 
adc.database_name, 
ag.name AS ag_name, 
case HDRS.is_primary_replica
when 1 then 'Primary Replica'
else 'Secondary Replica'
end as Replica,
HDRS.synchronization_state_desc, 
HDRS.synchronization_health_desc, 
HDRS.recovery_lsn, 
HDRS.truncation_lsn, 
HDRS.last_sent_lsn, 
HDRS.last_sent_time, 
HDRS.last_received_lsn, 
HDRS.last_received_time, 
HDRS.last_hardened_lsn, 
HDRS.last_hardened_time, 
HDRS.last_redone_lsn, 
HDRS.last_redone_time, 
HDRS.log_send_queue_size, 
HDRS.log_send_rate, 
HDRS.redo_queue_size, 
HDRS.redo_rate, 
HDRS.filestream_send_rate, 
HDRS.end_of_log_lsn, 
HDRS.last_commit_lsn, 
HDRS.last_commit_time
FROM sys.dm_hadr_database_replica_states AS HDRS
INNER JOIN sys.availability_databases_cluster AS adc 
ON HDRS.group_id = adc.group_id AND 
HDRS.group_database_id = adc.group_database_id
INNER JOIN sys.availability_groups AS ag
ON ag.group_id = HDRS.group_id
INNER JOIN sys.availability_replicas AS ar 
ON HDRS.group_id = ar.group_id AND 
HDRS.replica_id = ar.replica_id