diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ce5bcb..1404364 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,8 @@ on:
   pull_request:
   merge_group:
 
+permissions: write-all
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
@@ -20,25 +22,20 @@ jobs:
         include:
           - { java-version: "11", os: "windows-latest", os-label: "Windows" }
           - { java-version: "11", os: "macos-latest", os-label: "macOS" }
-
     steps:
       - uses: actions/checkout@v4
-      
       - name: Set up JDK ${{ matrix.java-version }}
         uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: ${{ matrix.java-version }}
           cache: 'maven'
-
       - name: Code style check
         run: mvn spotless:check
-
       - name: Build and Test with Coverage
         run: |
           mvn -pl api clean test-compile
           mvn -pl api test jacoco:report
-
       - name: Debug Test Results (Unix)
         if: runner.os != 'Windows'
         run: |
@@ -46,7 +43,6 @@ jobs:
           find . -name "TEST-*.xml" -exec cat {} \;
           echo "JaCoCo Report Location:"
           ls -la api/target/site/jacoco/
-          
       - name: Debug Test Results (Windows)
         if: runner.os == 'Windows'
         run: |
@@ -54,10 +50,8 @@ jobs:
           Get-ChildItem -Recurse -Filter "TEST-*.xml" | Get-Content
           echo "JaCoCo Report Location:"
           Get-ChildItem -Path "api\target\site\jacoco" -Force
-          
       - name: Generate JaCoCo Report
         run: mvn -pl api jacoco:report
-
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v5
         with:
@@ -73,4 +67,30 @@ jobs:
           path: ~/.m2
           key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
           restore-keys: |
-            ${{ runner.os }}-m2-
\ No newline at end of file
+            ${{ runner.os }}-m2-
+
+  test_success:
+    # this aggregates success state of all jobs listed in `needs`
+    # this is the only required check to pass CI
+    name: "Test success"
+    if: always()
+    runs-on: ubuntu-latest
+    needs: [ test ]
+    steps:
+      - name: "Success"
+        if: needs.test.result == 'success'
+        run: true
+        shell: bash
+      - name: "Failure"
+        if: needs.test.result != 'success'
+        run: false
+        shell: bash
+
+  draft:
+    runs-on: ubuntu-latest
+    needs: test_success
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - uses: release-drafter/release-drafter@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file