From 89ee22b12a261a5c875f177ab05cb583dee15211 Mon Sep 17 00:00:00 2001
From: Jamil Bou Kheir <jamilbk@users.noreply.github.com>
Date: Mon, 4 May 2026 08:18:07 -0700
Subject: [PATCH] fix: only draft release on push

---
 .github/workflows/ci.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5b31be1..386fe7f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -115,10 +115,14 @@ jobs:
       - run: mix test
 
   draft-release:
+    if: github.event_name == 'push'
     runs-on: ubuntu-24.04
     needs:
       - static-analysis
       - tests
+    permissions:
+      contents: write
+      pull-requests: read
     outputs:
       tag_name: ${{ steps.release_drafter.outputs.tag_name }}
     steps:
@@ -130,10 +134,13 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   build-release-nifs:
+    if: github.event_name == 'push'
     name: NIF ${{ matrix.nif }} - ${{ matrix.target }} (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
     needs:
       - draft-release
+    permissions:
+      contents: write
     defaults:
       run:
         working-directory: "./native/wireguard_nif"