Add honest Kotoba v1 E.164-looking check surface

.github/workflows/codeql.yml

@@ -17,6 +17,14 @@ on:
   pull_request:
     # The branches below must be a subset of the branches above
     branches: ["master"]
+    # Skip kotoba-only PRs; those run .github/workflows/kotoba-v1.yml.
+    paths:
+      - 'java/**'
+      - 'javascript/**'
+      - 'cpp/**'
+      - 'resources/**'
+      - 'tools/**'
+      - 'pom.xml'
   schedule:
     - cron: "0 0 * * 1"
 
@@ -41,12 +49,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
       - name: Checkout repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Protoc
         uses: arduino/setup-protoc@149f6c87b92550901b26acd1632e11c3662e381f # v1.3.0

.github/workflows/cpp-unit-test.yml

@@ -1,7 +1,13 @@
 # This workflow builds and unit tests both main C++ API and also build/data tools for metadata generation.
 
 name: Testing C++ API
-on: pull_request
+on:
+  pull_request:
+    # Skip kotoba-only PRs; those run .github/workflows/kotoba-v1.yml.
+    paths:
+      - 'cpp/**'
+      - 'tools/cpp/**'
+      - 'resources/**'
 permissions:
   contents: read
 
@@ -10,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
-    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set up C++ environment
       run: |

.github/workflows/dependency-review.yml

@@ -7,7 +7,17 @@
 #
 # Source repository: https://github.com/actions/dependency-review-action
 name: 'Dependency Review'
-on: [pull_request]
+on:
+  pull_request:
+    # Skip kotoba-only PRs; those run .github/workflows/kotoba-v1.yml.
+    paths-ignore:
+      - 'kotoba/**'
+      - '.github/workflows/kotoba-v1.yml'
+      - '.github/workflows/java-unit-test.yml'
+      - '.github/workflows/cpp-unit-test.yml'
+      - '.github/workflows/codeql.yml'
+      - '.github/workflows/osv-scanner-unified.yml'
+      - '.github/workflows/dependency-review.yml'
 
 permissions:
   contents: read
@@ -17,11 +27,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
       - name: 'Checkout Repository'
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@7d90b4f05fea31dde1c4a1fb3fa787e197ea93ab # v3.0.7

.github/workflows/java-unit-test.yml

@@ -1,7 +1,15 @@
 # This workflow builds and unit tests both main Java API and also build/data tools for metadata generation.
 
 name: Testing Java API
-on: pull_request
+on:
+  pull_request:
+    # Skip kotoba-only PRs; those run .github/workflows/kotoba-v1.yml.
+    paths:
+      - 'java/**'
+      - 'javascript/**'
+      - 'resources/**'
+      - 'tools/java/**'
+      - 'pom.xml'
 permissions:
   contents: read
 
@@ -10,11 +18,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
-    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up JDK 8 and Maven
       uses: actions/setup-java@cd89f46ac9d01407894225f350157564c9c7cee2 # v3.12.0
       with:
@@ -39,11 +47,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
-    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Install ascii-safe-cli
       run: npm install -g is-ascii-safe-cli
     - name: Check whether .js api files are ascii safe or not.

.github/workflows/kotoba-v1.yml

@@ -0,0 +1,45 @@
+name: Kotoba v1
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'kotoba/**'
+      - '.github/workflows/kotoba-v1.yml'
+  pull_request:
+    paths:
+      - 'kotoba/**'
+      - '.github/workflows/kotoba-v1.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  kotoba:
+    name: kotoba compile + fixture
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install kotoba v0.7.2
+        shell: bash
+        run: |
+          set -euo pipefail
+          release_dir="$RUNNER_TEMP/kotoba-v0.7.2"
+          cli_dir="$RUNNER_TEMP/kotoba-cli"
+          mkdir -p "$release_dir" "$cli_dir"
+          curl -L --fail --silent --show-error \
+            -o "$release_dir/kotoba-linux-amd64.tar.gz" \
+            https://github.com/kotoba-lang/kotoba/releases/download/v0.7.2/kotoba-linux-amd64.tar.gz
+          # Pin the digest published by GitHub's v0.7.2 release metadata.
+          # The adjacent .sha256 asset comes from the same mutable release.
+          printf '%s  %s\n' \
+            '95e225461e1b8a21849b251e8c8b654693d2c8a516b258532771651e978e1977' \
+            "$release_dir/kotoba-linux-amd64.tar.gz" | sha256sum --check --strict -
+          tar -xzf "$release_dir/kotoba-linux-amd64.tar.gz" -C "$cli_dir"
+          echo "$cli_dir" >> "$GITHUB_PATH"
+
+      - name: Compile wasm and run fixture
+        run: kotoba/checks.sh

.github/workflows/osv-scanner-unified.yml

@@ -18,22 +18,30 @@ name: OSV-Scanner
 on:
   pull_request:
     branches: ["master"]
+    # Skip kotoba-only PRs; those run .github/workflows/kotoba-v1.yml.
+    paths-ignore:
+      - 'kotoba/**'
+      - '.github/workflows/kotoba-v1.yml'
+      - '.github/workflows/java-unit-test.yml'
+      - '.github/workflows/cpp-unit-test.yml'
+      - '.github/workflows/codeql.yml'
+      - '.github/workflows/dependency-review.yml'
+      - '.github/workflows/osv-scanner-unified.yml'
   schedule:
   - cron: "12 12 * * 1"
   push:
     branches: ["master"]
 
 permissions:
-  # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117
-  actions: read
-  # Require writing security events to upload SARIF file to security tab
-  security-events: write
-  # Read commit contents
   contents: read
 
 jobs:
   scan-scheduled:
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     # If you want to copy this config, highly suggest pinning this version to a release rather than tracking the main branch
     uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@8bd1ce1c4be9d98053ffd9e6e14585276a36762c" # v1.9.1
     with:
@@ -44,6 +52,10 @@ jobs:
         ./
   scan-pr:
     if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     # If you want to copy this config, highly suggest pinning this version to a release rather than tracking the main branch
     uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@8bd1ce1c4be9d98053ffd9e6e14585276a36762c" # v1.9.1
     with:

kotoba/README.md

@@ -0,0 +1,84 @@
+# Kotoba v1 for libphonenumber
+
+First-class sibling tree to `cpp/`, `java/`, and `javascript/`. This directory
+is a Kotoba check surface for the fork, not a language binding over the Java,
+C++, or JavaScript libraries.
+
+Public operator: awai.network. Sales: Ryo Awai.
+
+License: Apache-2.0 (same as this repository).
+
+## Honest scope
+
+v1 checks whether a short hardcoded fixture is a **well-formed E.164-looking**
+string: a plus prefix plus a digit length.
+
+- First byte must be `+` (ASCII 43).
+- Every following byte must be an ASCII digit `0`–`9`.
+- Digit count must be in `2..15`.
+  - `15` is the ITU E.164 maximum for the complete international number.
+  - `2` is this repository's `PhoneNumberUtil.MIN_LENGTH_FOR_NSN`, applied
+    here to the complete digit string, not to a region national number.
+
+Two accept fixtures and two reject fixtures are taken from this repository's
+own testdata (`US_NUMBER` / `GB_NUMBER` in
+`java/libphonenumber/test/com/google/i18n/phonenumbers/PhoneNumberUtilTest.java`):
+
+| fixture | bytes | expected |
+|---|---|---|
+| `fixtures/us-e164.txt` | `+16502530000` | accept (E.164 of US_NUMBER) |
+| `fixtures/gb-e164.txt` | `+442070313000` | accept (E.164 of GB_NUMBER) |
+| `fixtures/us-international.txt` | `+1 650 253 0000` | reject (INTERNATIONAL spaces) |
+| `fixtures/us-nsn.txt` | `6502530000` | reject (national number, no plus) |
+
+This is **not**:
+
+- a drop-in replacement for the Java, C++, or JavaScript libraries
+- full region metadata / carrier / geocoding / timezone lookup
+- `isValidNumber`, `isPossibleNumber` against country ranges
+- parse, format, AsYouType, matcher, or short-number support
+- a copy of `resources/phonenumber.proto` or the metadata proto set
+- an FFI or JNI/C++ driver
+
+A full libphonenumber port will not fit on wasm32 i64-v1. That dialect has no
+IEEE floats, no admitted byte-builder, and no host imports in the
+host-independent profile. Shrinking to a plus-prefix digit-length check of a
+few project fixtures is the smallest codec/header/fixture that still proves a
+real accept and a real reject. The shrink is documented here, not stubbed.
+
+## Module
+
+`phonenumber.kotoba` is one compilation unit (`phonenumber.v1`).
+
+| export | meaning |
+|---|---|
+| `e164-looking` | `1` if fixture `id` is E.164-looking, else `0` |
+| `accept-us` / `accept-gb` | `1` if the matching accept fixture is admitted |
+| `reject-spaces` / `reject-nsn` | `1` if the matching reject fixture is refused |
+| `main` | `1` if both accepts and both rejects hold |
+
+## Build (kotoba CLI v0.7.2)
+
+Language authority: [kotoba-lang/kotoba-lang](https://github.com/kotoba-lang/kotoba-lang).
+CLI: [kotoba-lang/kotoba](https://github.com/kotoba-lang/kotoba) tag **v0.7.2**.
+
+```sh
+kotoba compile kotoba/phonenumber.kotoba --target wasm --output phonenumber.wasm --json
+```
+
+Accept `kotoba.cli/ok?` true, `kotoba.cli/code` `emitted`,
+`value-profile` `i64-v1`. The artifact is host-independent wasm32
+(`wasm32-kotoba-v1`, `value-abi` `direct-v1`): no `kotoba:typed` imports, no
+libphonenumber native code.
+
+`kotoba compile --target wasm --run` is not used. The i64-v1 guest does not
+match the kototama/chicory runner on v0.7.2. Fixture execution is
+`--target web --run` (`js-kotoba-v1`), which still reports `value-profile`
+`i64-v1`.
+
+```sh
+kotoba/checks.sh
+```
+
+Install the CLI from the v0.7.2 release tarball or
+`brew tap kotoba-lang/kotoba && brew trust kotoba-lang/kotoba && brew install kotoba`.