Unify publish.yml to include Java via workflow_call (#1938)

* Initial plan

* feat: unify publish.yml to include Java via workflow_call

- Add workflow_call trigger to java-publish-maven.yml alongside
  existing workflow_dispatch (inputs mirrored exactly)
- Add publish-java job to publish.yml that calls the Java workflow
  with releaseVersion and prerelease inputs, skipped for unstable
- Update github-release job to use always() with explicit per-language
  status checks so Java failure doesn't block cross-language release

Closes #1874

Co-authored-by: edburns <75821+edburns@users.noreply.github.com>

* Fix review comments: declare workflow_call secrets, gate Java publish to main, accept preview version format

Co-authored-by: edburns <75821+edburns@users.noreply.github.com>

* Tighten version regex: use unified alternation to prevent ambiguous suffix combinations

Co-authored-by: edburns <75821+edburns@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: edburns <75821+edburns@users.noreply.github.com>
Co-authored-by: Ed Burns <edburns@microsoft.com>

Author: Copilot

.github/workflows/java-publish-maven.yml

@@ -22,6 +22,34 @@ on:
         type: boolean
         required: false
         default: false
+  workflow_call:
+    inputs:
+      releaseVersion:
+        description: "Release version (e.g., 1.0.0). If empty, derives from pom.xml by removing -SNAPSHOT"
+        required: false
+        type: string
+      developmentVersion:
+        description: "Next development version (e.g., 1.0.1-SNAPSHOT). If empty, increments patch version"
+        required: false
+        type: string
+      prerelease:
+        description: "Is this a prerelease?"
+        type: boolean
+        required: false
+        default: false
+    secrets:
+      JAVA_RELEASE_TOKEN:
+        required: true
+      JAVA_RELEASE_GITHUB_TOKEN:
+        required: true
+      JAVA_MAVEN_CENTRAL_USERNAME:
+        required: true
+      JAVA_MAVEN_CENTRAL_PASSWORD:
+        required: true
+      JAVA_GPG_SECRET_KEY:
+        required: true
+      JAVA_GPG_PASSPHRASE:
+        required: true
 
 permissions:
   contents: write
@@ -144,10 +172,10 @@ jobs:
               exit 1
             fi
           else
-            # Split version: supports "0.1.32", "0.1.32-java.0", and "0.1.32-java-preview.0" formats
+            # Split version: supports "0.1.32", "0.1.32-preview.0", "0.1.32-java.0", and "0.1.32-java-preview.0" formats
             # Validate RELEASE_VERSION format explicitly to provide clear errors
-            if ! echo "$RELEASE_VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-(beta-)?java(-preview)?\.[0-9]+)?$'; then
-              echo "Error: RELEASE_VERSION '$RELEASE_VERSION' is invalid. Expected format: M.M.P, M.M.P-java.N, M.M.P-java-preview.N, M.M.P-beta-java.N, or M.M.P-beta-java-preview.N (e.g., 1.2.3, 1.2.3-java.0, 1.2.3-java-preview.0, 1.2.3-beta-java.0, or 1.2.3-beta-java-preview.0)." >&2
+            if ! echo "$RELEASE_VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-(preview|(beta-)?java(-preview)?)\.[0-9]+)?$'; then
+              echo "Error: RELEASE_VERSION '$RELEASE_VERSION' is invalid. Expected format: M.M.P, M.M.P-preview.N, M.M.P-java.N, M.M.P-java-preview.N, M.M.P-beta-java.N, or M.M.P-beta-java-preview.N (e.g., 1.2.3, 1.2.3-preview.0, 1.2.3-java.0, 1.2.3-java-preview.0, 1.2.3-beta-java.0, or 1.2.3-beta-java-preview.0)." >&2
               exit 1
             fi
             # Extract the base M.M.P portion (before any qualifier)

.github/workflows/publish.yml

@@ -229,10 +229,28 @@ jobs:
         with:
           packages-dir: python/dist/
 
+  publish-java:
+    name: Publish Java SDK
+    if: github.event.inputs.dist-tag != 'unstable' && github.ref == 'refs/heads/main'
+    needs: version
+    uses: ./.github/workflows/java-publish-maven.yml
+    with:
+      releaseVersion: ${{ needs.version.outputs.version }}
+      prerelease: ${{ github.event.inputs.dist-tag == 'prerelease' }}
+    secrets: inherit
+
   github-release:
     name: Create GitHub Release
-    needs: [version, publish-nodejs, publish-dotnet, publish-python, publish-rust]
-    if: github.ref == 'refs/heads/main' && github.event.inputs.dist-tag != 'unstable'
+    needs: [version, publish-nodejs, publish-dotnet, publish-python, publish-rust, publish-java]
+    if: |
+      always() &&
+      github.ref == 'refs/heads/main' &&
+      github.event.inputs.dist-tag != 'unstable' &&
+      needs.version.result == 'success' &&
+      needs.publish-nodejs.result == 'success' &&
+      needs.publish-dotnet.result == 'success' &&
+      needs.publish-python.result == 'success' &&
+      needs.publish-rust.result == 'success'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6.0.2