Merge branch 'refs/heads/master' into dwc2_ep0

# Conflicts:
#	examples/device/dfu/src/usb_descriptors.c
#	examples/device/dfu_runtime/src/usb_descriptors.c
#	src/device/usbd_control.c
#	src/portable/synopsys/dwc2/dcd_dwc2.c

3 files changed, 35 insertions, 5 deletions

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 9982583cd..9f9ab7e72 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -88,6 +88,30 @@ python3 tools/build.py -b BOARD_NAME
 - Check spelling: `pip install codespell && codespell` (uses `.codespellrc` config)
 - Pre-commit hooks validate unit tests and code quality automatically
 
+### Static Analysis with PVS-Studio
+- **Analyze whole project**:
+  ```bash
+  pvs-studio-analyzer analyze -f examples/cmake-build-raspberry_pi_pico/compile_commands.json -R .PVS-Studio/.pvsconfig -o pvs-report.log -j12 --dump-files --misra-cpp-version 2008 --misra-c-version 2023 --use-old-parser
+  ```
+- **Analyze specific source files**:
+  ```bash
+  pvs-studio-analyzer analyze -f examples/cmake-build-raspberry_pi_pico/compile_commands.json -R .PVS-Studio/.pvsconfig -S path/to/file.c -o pvs-report.log -j12 --dump-files --misra-cpp-version 2008 --misra-c-version 2023 --use-old-parser
+  ```
+- **Multiple specific files**:
+  ```bash
+  pvs-studio-analyzer analyze -f examples/cmake-build-raspberry_pi_pico/compile_commands.json -R .PVS-Studio/.pvsconfig -S src/file1.c -S src/file2.c -o pvs-report.log -j12 --dump-files --misra-cpp-version 2008 --misra-c-version 2023 --use-old-parser
+  ```
+- Requires `compile_commands.json` in the build directory (generated by CMake with `-DCMAKE_EXPORT_COMPILE_COMMANDS=ON`)
+- Use `-f` option to specify path to `compile_commands.json`
+- Use `-R .PVS-Studio/.pvsconfig` to specify rule configuration file
+- Use `-j12` for parallel analysis with 12 threads
+- `--dump-files` saves preprocessed files for debugging
+- `--misra-c-version 2023` enables MISRA C:2023 checks
+- `--misra-cpp-version 2008` enables MISRA C++:2008 checks
+- `--use-old-parser` uses legacy parser for compatibility
+- Analysis takes ~10-30 seconds depending on project size. Set timeout to 5+ minutes.
+- View results: `plog-converter -a GA:1,2 -t errorfile pvs-report.log` or open in PVS-Studio GUI
+
 ## Validation
 
 ### ALWAYS Run These After Making Changes
diff --git a/.github/workflows/build_util.yml b/.github/workflows/build_util.yml
index a2c96f3c0..55901b838 100644
--- a/.github/workflows/build_util.yml
+++ b/.github/workflows/build_util.yml
@@ -60,8 +60,9 @@ jobs:
       - name: Build
         env:
           IAR_LMS_BEARER_TOKEN: ${{ secrets.IAR_LMS_BEARER_TOKEN }}
+          TOOLCHAIN: ${{ inputs.toolchain }}
         run: |
-          if [ "${{ inputs.toolchain }}" == "esp-idf" ]; then
+          if [ "$TOOLCHAIN" == "esp-idf" ]; then
             docker run --rm -v $PWD:/project -w /project espressif/idf:tinyusb python tools/build.py ${{ matrix.arg }}
           else
             python tools/build.py -s ${{ inputs.build-system }} ${{ steps.setup-toolchain.outputs.build_option }} ${{ steps.set-one-per-family.outputs.build_option }} ${{ matrix.arg }}
diff --git a/.github/workflows/static_analysis.yml b/.github/workflows/static_analysis.yml
index 7e74f77ce..4db267517 100644
--- a/.github/workflows/static_analysis.yml
+++ b/.github/workflows/static_analysis.yml
@@ -90,7 +90,8 @@ jobs:
           path: ${{ steps.analyze.outputs.sarif-output }}
 
   PVS-Studio:
-    if: github.repository_owner == 'hathach'
+    # Only run on non-forked PR since secrets token is required
+    if: github.repository_owner == 'hathach' && github.event.pull_request.head.repo.fork == false
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -118,13 +119,14 @@ jobs:
           sudo apt update
           sudo apt install pvs-studio
           pvs-studio-analyzer credentials ${{ secrets.PVS_STUDIO_CREDENTIALS }}
+          pvs-studio-analyzer --version
 
       - name: Analyze
         run: |
           mkdir -p build
           cmake examples -B build -G Ninja -DBOARD=${{ matrix.board }} -DCMAKE_BUILD_TYPE=MinSizeRel
           cmake --build build
-          pvs-studio-analyzer analyze -R .PVS-Studio/.pvsconfig -f build/compile_commands.json --exclude-path hw/mcu/ --exclude-path lib/ -j
+          pvs-studio-analyzer analyze -f build/compile_commands.json -R .PVS-Studio/.pvsconfig -j4 --security-related-issues --misra-cpp-version 2008 --misra-c-version 2023 --use-old-parser -e lib/ -e hw/mcu/ -e */iar/cxarm/ -e pico-sdk/
           plog-converter -t sarif -o pvs-studio-${{ matrix.board }}.sarif PVS-Studio.log
 
       - name: Upload SARIF
@@ -140,7 +142,8 @@ jobs:
           path: pvs-studio-${{ matrix.board }}.sarif
 
   SonarQube:
-    if: github.repository_owner == 'hathach'
+    # Only run on non-forked PR since secrets token is required
+    if: github.repository_owner == 'hathach' && github.event.pull_request.head.repo.fork == false
     runs-on: ubuntu-latest
     env:
       BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory
@@ -183,7 +186,9 @@ jobs:
             --define sonar.cfamily.compile-commands=${{ env.BUILD_WRAPPER_OUT_DIR }}/compile_commands.json
 
   IAR-CStat:
-    if: github.repository_owner == 'hathach'
+    # Only run on non-forked PR since secrets token is required
+    #if: github.repository_owner == 'hathach' && github.event.pull_request.head.repo.fork == false
+    if: false
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false