upload metrics.json and metrics compare to release page (#3409)

* upload metrics.json and metrics compare to release page
* Adjust workflow comment handling for forks

6 files changed, 43 insertions, 15 deletions

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c062aca46..781d3b002 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,6 +27,8 @@ on:
       - '.github/workflows/build.yml'
       - '.github/workflows/build_util.yml'
       - '.github/workflows/ci_set_matrix.py'
+  release:
+    types: [ published ]
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -42,7 +44,7 @@ jobs:
       hil_json: ${{ steps.set-matrix-json.outputs.hil_matrix }}
     steps:
       - name: Checkout TinyUSB
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Generate matrix json
         id: set-matrix-json
@@ -86,9 +88,12 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
+      contents: write
     steps:
       - name: Checkout TinyUSB
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+        with:
+          fetch-tags: ${{ github.event_name == 'release' }}
 
       - name: Download Artifacts
         uses: actions/download-artifact@v5
@@ -103,14 +108,14 @@ jobs:
           python tools/metrics.py combine -j -m -f tinyusb/src cmake-build/*/metrics.json
 
       - name: Upload Metrics Artifact
-        if: github.event_name == 'push'
+        if: github.event_name == 'push' || github.event_name == 'release'
         uses: actions/upload-artifact@v5
         with:
           name: metrics-tinyusb
           path: metrics.json
 
       - name: Download Base Branch Metrics
-        if: github.event_name != 'push'
+        if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
         uses: dawidd6/action-download-artifact@v11
         with:
           workflow: build.yml
@@ -119,6 +124,18 @@ jobs:
           path: base-metrics
         continue-on-error: true
 
+      - name: Download Previous Release Asset
+        if: github.event_name == 'release'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          PREV_TAG=$(git tag --sort=-creatordate | head -n 2 | tail -n 1)
+          echo "Previous Release: $PREV_TAG"
+          echo "PREV_TAG=$PREV_TAG" >> $GITHUB_ENV
+
+          mkdir -p base-metrics
+          gh release download $PREV_TAG -p metrics.json -D base-metrics || echo "No metrics.json found in $PREV_TAG release"
+
       - name: Compare with Base Branch
         if: github.event_name != 'push'
         run: |
@@ -130,6 +147,16 @@ jobs:
             cp metrics.md metrics_compare.md
           fi
 
+      - name: Upload Release Assets
+        if: github.event_name == 'release'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          CURR_TAG=${{ github.event.release.tag_name }}
+          COMPARE_FILE="metrics_compare_${CURR_TAG}-${PREV_TAG}.md"
+          mv metrics_compare.md $COMPARE_FILE
+          gh release upload $CURR_TAG metrics.json $COMPARE_FILE
+
       - name: Save PR number
         if: github.event_name == 'pull_request'
         run: echo ${{ github.event.number }} > pr_number.txt
@@ -144,7 +171,7 @@ jobs:
             pr_number.txt
 
       - name: Post Code Metrics as PR Comment
-        if: github.event_name != 'push'
+        if: (github.event_name == 'workflow_dispatch') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)
         uses: marocchino/sticky-pull-request-comment@v2
         with:
           header: code-metrics
@@ -175,7 +202,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout TinyUSB
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Zephyr project
         uses: zephyrproject-rtos/action-zephyr-setup@v1
@@ -237,7 +264,7 @@ jobs:
           mkdir -p "${{ github.workspace }}"
 
       - name: Checkout TinyUSB
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Download Artifacts
         uses: actions/download-artifact@v5
@@ -275,7 +302,7 @@ jobs:
           iccarm --version
 
       - name: Checkout TinyUSB
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Get build boards
         run: |
diff --git a/.github/workflows/build_util.yml b/.github/workflows/build_util.yml
index 1cbd02f1b..540ee8b47 100644
--- a/.github/workflows/build_util.yml
+++ b/.github/workflows/build_util.yml
@@ -38,7 +38,7 @@ jobs:
         arg: ${{ fromJSON(inputs.build-args) }}
     steps:
       - name: Checkout TinyUSB
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Toolchain
         id: setup-toolchain
diff --git a/.github/workflows/metrics_comment.yml b/.github/workflows/metrics_comment.yml
index 2f1b0d631..7443f7367 100644
--- a/.github/workflows/metrics_comment.yml
+++ b/.github/workflows/metrics_comment.yml
@@ -13,6 +13,7 @@ jobs:
       github.event.workflow_run.event == 'pull_request' &&
       github.event.workflow_run.conclusion == 'success'
     permissions:
+      actions: read
       pull-requests: write
     steps:
       - name: Download Artifacts
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index ed0efd66e..b9bfaf9b6 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -20,7 +20,7 @@ jobs:
         ruby-version: '3.0'
 
     - name: Checkout TinyUSB
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: Get Dependencies
       run: |
diff --git a/.github/workflows/static_analysis.yml b/.github/workflows/static_analysis.yml
index 4db267517..a78682d7a 100644
--- a/.github/workflows/static_analysis.yml
+++ b/.github/workflows/static_analysis.yml
@@ -37,7 +37,7 @@ jobs:
           - 'metro_m4_express'
     steps:
       - name: Checkout TinyUSB
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Get Dependencies
         uses: ./.github/actions/get_deps
@@ -100,7 +100,7 @@ jobs:
           - 'raspberry_pi_pico'
     steps:
       - name: Checkout TinyUSB
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Get Dependencies
         uses: ./.github/actions/get_deps
@@ -154,7 +154,7 @@ jobs:
           - 'stm32h743eval'
     steps:
       - name: Checkout TinyUSB
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
 
@@ -197,7 +197,7 @@ jobs:
           - 'b_g474e_dpow1'
     steps:
       - name: Checkout TinyUSB
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Get Dependencies
         uses: ./.github/actions/get_deps
diff --git a/.github/workflows/trigger.yml b/.github/workflows/trigger.yml
index cf40ac955..fd7c0b713 100644
--- a/.github/workflows/trigger.yml
+++ b/.github/workflows/trigger.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: Push to tinyusb_src
       run: |