Add SHA2 integrity test using SHA-256 (works on MySQL 9.6+)

SHA2() is available on all MySQL versions. This test uses SHA-256
instead of SHA-1, making it the primary integrity test for MySQL 9.6+
where md5() and sha() were removed. Expected values are placeholders
pending first CI run to compute them.

Author: renecannao

.github/workflows/ci-mysql.yml

@@ -136,17 +136,18 @@ jobs:
           fi
           echo "SHA OK ($sha_ok matches)"
 
-      - name: Verify row counts (MySQL 9.6+ fallback)
-        if: steps.features.outputs.has_sha == 'false'
+      - name: Test SHA2 integrity
         run: |
-          SBDIR=$(ls -d ~/sandboxes/msb_*)
-          $SBDIR/use -BN -e "SELECT COUNT(*) FROM employees;" employees | grep -q 300024
-          $SBDIR/use -BN -e "SELECT COUNT(*) FROM departments;" employees | grep -q 9
-          $SBDIR/use -BN -e "SELECT COUNT(*) FROM dept_manager;" employees | grep -q 24
-          $SBDIR/use -BN -e "SELECT COUNT(*) FROM dept_emp;" employees | grep -q 331603
-          $SBDIR/use -BN -e "SELECT COUNT(*) FROM titles;" employees | grep -q 443308
-          $SBDIR/use -BN -e "SELECT COUNT(*) FROM salaries;" employees | grep -q 2844047
-          echo "Row counts OK"
+          EXTRA_ARGS=""
+          [ "${{ steps.features.outputs.needs_commands }}" == "true" ] && EXTRA_ARGS="--commands"
+          ~/sandboxes/msb_*/use $EXTRA_ARGS -t < test_employees_sha2.sql > /tmp/test_sha2.txt
+          cat /tmp/test_sha2.txt
+          sha2_ok=$(grep -iw ok /tmp/test_sha2.txt | wc -l | tr -d ' \t')
+          if [ "$sha2_ok" != "8" ]; then
+            echo "SHA2 FAIL - expected 8 OK - found $sha2_ok"
+            exit 1
+          fi
+          echo "SHA2 OK ($sha2_ok matches)"
 
       - name: Load objects (stored procedures/functions)
         run: |
@@ -290,6 +291,19 @@ jobs:
           fi
           echo "MD5 OK ($md5_ok matches)"
 
+      - name: Test SHA2 integrity
+        run: |
+          EXTRA_ARGS=""
+          [ "${{ steps.features.outputs.needs_commands }}" == "true" ] && EXTRA_ARGS="--commands"
+          ~/sandboxes/msb_*/use $EXTRA_ARGS -t < test_employees_sha2.sql > /tmp/test_sha2.txt
+          cat /tmp/test_sha2.txt
+          sha2_ok=$(grep -iw ok /tmp/test_sha2.txt | wc -l | tr -d ' \t')
+          if [ "$sha2_ok" != "8" ]; then
+            echo "SHA2 FAIL - expected 8 OK - found $sha2_ok"
+            exit 1
+          fi
+          echo "SHA2 OK ($sha2_ok matches)"
+
       - name: Cleanup
         if: always()
         run: |

test_employees_sha2.sql

@@ -0,0 +1,87 @@
+--  Test employees database integrity using SHA-256 checksums
+--  Uses SHA2() which is available on all MySQL versions (8.0+)
+--  This test works on MySQL 9.6+ where md5() and sha() have been removed
+
+USE employees;
+
+SELECT 'TESTING INSTALLATION' as 'INFO';
+
+DROP TABLE IF EXISTS expected_values, found_values;
+CREATE TABLE expected_values (
+    table_name varchar(30) not null primary key,
+    recs int not null,
+    crc_sha2 varchar(100) not null
+);
+
+
+CREATE TABLE found_values (LIKE expected_values);
+
+-- Expected SHA-256 checksums (computed from the canonical data set)
+INSERT INTO `expected_values` VALUES
+('employees',   300024, 'PLACEHOLDER'),
+('departments',      9, 'PLACEHOLDER'),
+('dept_manager',    24, 'PLACEHOLDER'),
+('dept_emp',    331603, 'PLACEHOLDER'),
+('titles',      443308, 'PLACEHOLDER'),
+('salaries',   2844047, 'PLACEHOLDER');
+SELECT table_name, recs AS expected_records, crc_sha2 AS expected_crc FROM expected_values;
+
+DROP TABLE IF EXISTS tchecksum;
+CREATE TABLE tchecksum (chk char(100));
+
+SET @crc= '';
+INSERT INTO tchecksum
+    SELECT @crc := SHA2(CONCAT_WS('#',@crc,
+                emp_no,birth_date,first_name,last_name,gender,hire_date), 256)
+    FROM employees ORDER BY emp_no;
+INSERT INTO found_values VALUES ('employees', (SELECT COUNT(*) FROM employees), @crc);
+
+SET @crc = '';
+INSERT INTO tchecksum
+    SELECT @crc := SHA2(CONCAT_WS('#',@crc, dept_no,dept_name), 256)
+    FROM departments ORDER BY dept_no;
+INSERT INTO found_values VALUES ('departments', (SELECT COUNT(*) FROM departments), @crc);
+
+SET @crc = '';
+INSERT INTO tchecksum
+    SELECT @crc := SHA2(CONCAT_WS('#',@crc, dept_no,emp_no, from_date,to_date), 256)
+    FROM dept_manager ORDER BY dept_no,emp_no;
+INSERT INTO found_values VALUES ('dept_manager', (SELECT COUNT(*) FROM dept_manager), @crc);
+
+SET @crc = '';
+INSERT INTO tchecksum
+    SELECT @crc := SHA2(CONCAT_WS('#',@crc, dept_no,emp_no, from_date,to_date), 256)
+    FROM dept_emp ORDER BY dept_no,emp_no;
+INSERT INTO found_values VALUES ('dept_emp', (SELECT COUNT(*) FROM dept_emp), @crc);
+
+SET @crc = '';
+INSERT INTO tchecksum
+    SELECT @crc := SHA2(CONCAT_WS('#',@crc, emp_no, title, from_date,to_date), 256)
+    FROM titles ORDER BY emp_no,title, from_date;
+INSERT INTO found_values VALUES ('titles', (SELECT COUNT(*) FROM titles), @crc);
+
+SET @crc = '';
+INSERT INTO tchecksum
+    SELECT @crc := SHA2(CONCAT_WS('#',@crc, emp_no, salary, from_date,to_date), 256)
+    FROM salaries ORDER BY emp_no,from_date,to_date;
+INSERT INTO found_values VALUES ('salaries', (SELECT COUNT(*) FROM salaries), @crc);
+
+DROP TABLE tchecksum;
+
+SELECT table_name, recs AS found_records, crc_sha2 AS found_crc FROM found_values;
+
+SELECT
+    e.table_name,
+    IF(e.recs=f.recs,'OK', 'not ok') AS records_match,
+    IF(e.crc_sha2=f.crc_sha2,'ok','not ok') AS crc_match
+FROM
+    expected_values e INNER JOIN found_values f USING (table_name);
+
+SET @crc_fail=(SELECT COUNT(*) FROM expected_values e INNER JOIN found_values f ON (e.table_name=f.table_name) WHERE f.crc_sha2 != e.crc_sha2);
+SET @count_fail=(SELECT COUNT(*) FROM expected_values e INNER JOIN found_values f ON (e.table_name=f.table_name) WHERE f.recs != e.recs);
+
+SELECT 'CRC' AS summary, IF(@crc_fail = 0, "OK", "FAIL") AS `result`
+UNION ALL
+SELECT 'count', IF(@count_fail = 0, "OK", "FAIL") AS `count`;
+
+DROP TABLE expected_values, found_values;