Add @MinIndexUsageDays to IndexOptimize for safe skipping of unused indexes

.gitattributes

@@ -1 +1,3 @@
-*.sql linguist-language=TSQL
+*.sql linguist-language=TSQL -text
+.github export-ignore
+.gitattributes export-ignore

.github/workflows/check-scripts.yml

@@ -0,0 +1,174 @@
+name: Check scripts
+
+# Verifies that the scripts in the repository are consistent with each other before a pull request can be merged.
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main                      # confirms that main itself is consistent after a merge
+  workflow_dispatch:              # adds a manual "Run workflow" button, handy for testing
+
+jobs:
+  checksums:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v5
+
+      - name: Check that every script is listed in SHA256SUMS.txt
+        run: |
+          ls *.sql | sort > /tmp/scripts.txt
+          awk '{print $2}' SHA256SUMS.txt | sort > /tmp/listed.txt
+          if ! diff /tmp/scripts.txt /tmp/listed.txt; then
+            echo "The scripts in the repository and the files listed in SHA256SUMS.txt do not match."
+            echo "Lines starting with < are scripts that are not listed; lines starting with > are listed files that do not exist."
+            exit 1
+          fi
+          echo "All scripts are listed."
+
+      - name: Check that the checksums are current
+        run: sha256sum -c SHA256SUMS.txt
+
+  versions:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v5
+
+      - name: Check that every script has the same version timestamp
+        run: |
+          set -u
+
+          # Every script in a release is built at the same time and stamped with that time.
+          # The installation scripts contain one stamp per stored procedure they include, so this also detects an installation script built from an outdated procedure.
+          PATTERN='Version: [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}'
+
+          echo "Version timestamps found in each script:"
+          for f in *.sql; do
+            STAMPS=$(grep -hoE "$PATTERN" "$f" | sed 's/^Version: //' | sort -u | tr '\n' ' ')
+            printf '  %-42s %s\n' "$f" "${STAMPS:-(none)}"
+          done
+
+          ALL=$(grep -hoE "$PATTERN" *.sql | sed 's/^Version: //' | sort -u)
+          COUNT=$(printf '%s\n' "$ALL" | grep -c . || true)
+
+          echo
+          if [ "$COUNT" -eq 0 ]; then
+            echo "No version timestamps were found. The scripts are expected to carry one."
+            exit 1
+          fi
+          if [ "$COUNT" -ne 1 ]; then
+            echo "The scripts do not all have the same version timestamp:"
+            printf '%s\n' "$ALL" | sed 's/^/  /'
+            exit 1
+          fi
+          echo "All scripts have the same version timestamp: $ALL"
+
+  timestamp:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0          # the base commit is needed to read the previous version timestamp
+
+      - name: Check that the version timestamp moves forward
+        if: github.event_name == 'pull_request'
+        run: |
+          set -u
+
+          # Every release is built from scratch and stamped with the time of the build, so the timestamp always moves forward.
+          # A timestamp that has gone backwards means the scripts were copied from an older build folder.
+          BASE='${{ github.event.pull_request.base.sha }}'
+          PATTERN='Version: [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}'
+
+          OLD=$(git show "$BASE:DatabaseBackup.sql" | grep -m1 -oE "$PATTERN" | sed 's/^Version: //')
+          NEW=$(grep -m1 -oE "$PATTERN" DatabaseBackup.sql | sed 's/^Version: //')
+
+          if [ -z "$OLD" ] || [ -z "$NEW" ]; then
+            echo "A version timestamp could not be read from DatabaseBackup.sql."
+            exit 1
+          fi
+
+          if [ "$NEW" = "$OLD" ]; then
+            if git diff --quiet "$BASE" -- '*.sql'; then
+              echo "The scripts have not changed. Version timestamp $NEW."
+              exit 0
+            fi
+            echo "The scripts have changed but the version timestamp is still $NEW."
+            echo "Every change to the scripts should come from a build."
+            exit 1
+          fi
+
+          if [ "$NEW" \< "$OLD" ]; then
+            echo "The version timestamp has gone backwards: $OLD -> $NEW."
+            echo "This usually means the scripts were copied from an older build folder."
+            exit 1
+          fi
+
+          echo "The version timestamp has moved forward: $OLD -> $NEW"
+
+  installers:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v5
+
+      - name: Check that the installation scripts contain the same code as the separate scripts
+        run: |
+          python3 - << 'EOF'
+          import sys
+
+          BOM = b"\xef\xbb\xbf"
+
+          # Which separate scripts each installation script is built from, in order.
+          INSTALLERS = {
+              "MaintenanceSolution.sql": [
+                  "CommandLog.sql", "CommandExecute.sql", "DatabaseBackup.sql",
+                  "DatabaseIntegrityCheck.sql", "IndexOptimize.sql"],
+              "MaintenanceSolutionAzureSQLDatabase.sql": [
+                  "CommandLog.sql", "CommandExecute.sql",
+                  "DatabaseIntegrityCheck.sql", "IndexOptimize.sql"],
+          }
+
+          def read(path):
+              data = open(path, "rb").read()
+              return data[len(BOM):] if data.startswith(BOM) else data
+
+          def body(path):
+              # The separate scripts have one line terminator appended after they have been merged into the installation scripts, so the merged copy is the file without it.
+              return read(path).rstrip(b"\r\n")
+
+          failures = 0
+          for installer, objects in INSTALLERS.items():
+              data = read(installer)
+              print("%s (%d bytes)" % (installer, len(data)))
+              position = None
+              for name in objects:
+                  part = body(name)
+                  found = data.find(part)
+                  if found < 0:
+                      print("  FAIL %s: the code is not in the installation script" % name)
+                      failures += 1
+                      break
+                  if position is not None and found != position:
+                      print("  FAIL %s: starts at byte %d, but the previous script ends at byte %d"
+                            % (name, found, position))
+                      failures += 1
+                      break
+                  print("  OK   %-28s %8d bytes at byte %d" % (name, len(part), found))
+                  position = found + len(part) + 2      # one line terminator between the scripts
+              else:
+                  # The header and the footer are not in the repository, so the bytes before the first script and after the last one are not checked.
+                  print("       (%d bytes before the first script, %d bytes after the last)"
+                        % (data.find(body(objects[0])), len(data) - position))
+              print()
+
+          if failures:
+              print("Rebuild the installation scripts so that every file comes from the same build.")
+              sys.exit(1)
+          print("The installation scripts contain the same code as the separate scripts.")
+          EOF

.github/workflows/create-tag.yml

@@ -0,0 +1,56 @@
+name: Create tag from version header
+
+# Runs every time you push/merge a commit to main. It reads the version timestamp out of the script header and creates a matching, immutable Git tag.
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - MaintenanceSolution.sql   # only run when this file actually changes
+
+permissions:
+  contents: write        # allow the workflow to create and push a tag
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0     # full history so existing tags are visible
+
+      - name: Read version from header and create tag
+        run: |
+          set -euo pipefail
+
+          # 1. Pull the "YYYY-MM-DD HH:MM:SS" timestamp out of the header.
+          VERSION=$(grep -m1 -oP '(?<=--// Version: )\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}' MaintenanceSolution.sql || true)
+
+          if [ -z "$VERSION" ]; then
+            echo "No version line found in MaintenanceSolution.sql - nothing to tag."
+            exit 0
+          fi
+
+          # 2. Turn it into a valid tag name.
+          #    Tags cannot contain spaces or colons, so strip the separators:
+          #    "2026-07-16 23:38:29"  ->  "20260716_233829"
+          TAG=$(echo "$VERSION" | sed 's/[-:]//g; s/ /_/')
+          echo "Version in header : $VERSION"
+          echo "Tag name          : $TAG"
+
+          # 3. If that tag already exists, do nothing (safe to re-run).
+          if git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then
+            echo "Tag $TAG already exists - skipping."
+            exit 0
+          fi
+
+          # 4. Create an annotated tag on this commit and push it.
+          #    Annotated tags carry a tagger and date, so the runner needs a git identity.
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          git tag -a "$TAG" -m "Version: $VERSION"
+          git push origin "refs/tags/$TAG"
+          echo "Created tag $TAG"

.github/workflows/deploy-website.yml

@@ -0,0 +1,86 @@
+name: Deploy to website
+
+# Uploads the released files to the website over FTPS whenever a release is merged to main.
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - MaintenanceSolution.sql   # a release always updates this file
+  workflow_dispatch:              # adds a manual "Run workflow" button, handy for testing
+
+env:
+  REMOTE_DIR: "/public_html/scripts"   # scripts folder on the server
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v5
+
+      - name: Install lftp (FTPS client)
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq lftp
+
+      - name: Upload files over FTPS
+        env:
+          FTP_SERVER: ${{ secrets.FTP_SERVER }}
+          FTP_USERNAME: ${{ secrets.FTP_USERNAME }}
+          LFTP_PASSWORD: ${{ secrets.FTP_PASSWORD }}
+        run: |
+          set -u
+
+          # Upload order: components first, then the installers, SHA256SUMS.txt last
+          # (the checksums go live only after the files they describe are in place).
+          FILES="CommandLog.sql Queue.sql QueueDatabase.sql CommandExecute.sql DatabaseBackup.sql DatabaseIntegrityCheck.sql IndexOptimize.sql MaintenanceSolutionAzureSQLDatabase.sql MaintenanceSolution.sql SHA256SUMS.txt"
+
+          # Explicit FTPS (AUTH TLS) on port 21
+          SETTINGS="set ftp:ssl-force true; set ftp:ssl-protect-data true; set ssl:verify-certificate true; set net:max-retries 2; set net:timeout 60"
+
+          # The password is read from the LFTP_PASSWORD environment variable, keeping it off the command line and out of the process table.
+          run_lftp () {
+            lftp -p 21 --env-password -u "$FTP_USERNAME" -e "$SETTINGS; $1; bye" "$FTP_SERVER"
+          }
+
+          # Two-phase upload.
+          # Phase 1 uploads ALL files under temporary names.
+          # Phase 2 renames the temp files into place.
+          UPLOAD=""
+          for f in $FILES; do
+            UPLOAD="$UPLOAD put $f -o $REMOTE_DIR/$f.tmp;"
+          done
+          for f in $FILES; do
+            UPLOAD="$UPLOAD mv $REMOTE_DIR/$f.tmp $REMOTE_DIR/$f;"
+          done
+
+          # Verification: list the files on the server and compare each size, byte for byte, against the file in the repository.
+          verify () {
+            LISTING=$(run_lftp "cls -s --block-size=1 $REMOTE_DIR/*.sql $REMOTE_DIR/SHA256SUMS.txt") || return 1
+            for f in $FILES; do
+              LOCAL=$(stat -c %s "$f")
+              REMOTE=$(printf '%s\n' "$LISTING" | grep "/$f\$" | awk '{print $1}')
+              if [ "$LOCAL" != "$REMOTE" ]; then
+                echo "VERIFY FAILED: $f is $LOCAL bytes in the repo but ${REMOTE:-missing} on the server"
+                return 1
+              fi
+              echo "Verified $f ($LOCAL bytes)"
+            done
+            return 0
+          }
+
+          # Try the whole upload-and-verify up to 3 times
+          for attempt in 1 2 3; do
+            echo "=== Upload attempt $attempt of 3 ==="
+            if run_lftp "$UPLOAD" && verify; then
+              echo "Deploy succeeded and verified."
+              exit 0
+            fi
+            if [ "$attempt" -lt 3 ]; then
+              echo "Attempt $attempt failed - waiting 120 seconds before retrying."
+              sleep 120
+            fi
+          done
+
+          echo "All attempts failed. The website may be behind or partially updated; re-run this workflow when the host is reachable to make it consistent."
+          exit 1