chore(ci): use common workflows for undraft/verify tag

[SoulPancake]

• Add a verify-version job that fails the tag build if the tag, manifest, build.gradle, and publish.gradle versions disagree -- catching the kind of drift that caused the 0.3.1/0.3.2 publish failure.
• Replace the Roang-zero1 create-release job (which produced duplicate untagged-* drafts) with the shared openfga/.github undraft-release.yml reusable, which undrafts the tag-keyed release created by release-please after a successful publish.
• Gate publish jobs on verify-version and add a top-level read permission.
• Exclude CHANGELOG.md from spotless flexmark so the machine-generated changelog no longer fails formatting checks on release PRs.

Description

What problem is being solved?

How is it being solved?

What changes are made to solve it?

References

Review Checklist

• I have clicked on "allow edits by maintainers".
• I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
• The correct base branch is being used, if not main
• I have added tests to validate that the change in functionality is working as expected

Summary by CodeRabbit

• New Features
  • Added automated version verification before package publishing.
  • Updated release handling to safely publish and undraft releases through a pinned workflow.
• Bug Fixes
  • Prevented changelog formatting checks from modifying or processing CHANGELOG.md.
• Security
  • Restricted workflow permissions to the minimum required access.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b31c0afc-69b1-4d9b-b990-57f1ede71e67

📥 Commits

Reviewing files that changed from the base of the PR and between 75d00a3 and e3142a2.

📒 Files selected for processing (2)

• .github/workflows/main.yaml
• build.gradle

---

Walkthrough

The workflow restricts default permissions, verifies release versions before publishing, and uses a pinned reusable workflow to undraft releases. Spotless Flexmark formatting now excludes CHANGELOG.md.

Changes

CI and release workflow

Layer / File(s)	Summary
Version validation and release workflow .github/workflows/main.yaml	Adds read-only default permissions, verifies tag and project versions before publishing, gates both publishing jobs on verification, and replaces release creation with a pinned undraft workflow using write permission.

Formatting configuration

Layer / File(s)	Summary
Changelog formatting exclusion build.gradle	Excludes CHANGELOG.md from the Spotless Flexmark target set.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main CI release workflow changes: shared undraft-release and version verification for tags.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/align-release-workflow-with-java-sdk

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[SoulPancake]

Also excluded changelog from the spotlessFmt because autogenerated release-please default doesn't match it and needs whitespace changes with our pushes too

[Copilot]

Pull request overview

Updates the repository’s release CI to rely on shared OpenFGA GitHub workflows and to prevent version drift during tag builds, while also avoiding Spotless failures from the machine-generated changelog.

Changes:

• Added a verify-version job for tag builds and gated publish jobs on it to catch version drift early.
• Replaced the custom draft release creation job with the shared openfga/.github undraft-release.yml reusable workflow.
• Excluded CHANGELOG.md from Spotless Flexmark formatting.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
build.gradle	Excludes CHANGELOG.md from Spotless Flexmark to prevent formatting failures on generated changelog updates.
.github/workflows/main.yaml	Adds a tag-only version verification gate, switches to a shared undraft workflow, and tightens default workflow permissions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.