From cea395b9b35c756e84b220630ceec55995e17b15 Mon Sep 17 00:00:00 2001
From: Will Winder <wwinder.unh@gmail.com>
Date: Fri, 23 Jan 2026 14:18:25 -0500
Subject: [PATCH 1/7] Pin version of openapitools.

---
 indexer/docs/.openapi-generator/VERSION |  2 +-
 indexer/generate-docs.sh                |  2 +-
 tools/bin/check_repo_clean.sh           | 53 +++++++++++++++++++++++++
 3 files changed, 55 insertions(+), 2 deletions(-)
 create mode 100755 tools/bin/check_repo_clean.sh

diff --git a/indexer/docs/.openapi-generator/VERSION b/indexer/docs/.openapi-generator/VERSION
index 193a12d6e..3821090fd 100644
--- a/indexer/docs/.openapi-generator/VERSION
+++ b/indexer/docs/.openapi-generator/VERSION
@@ -1 +1 @@
-7.20.0-SNAPSHOT
+7.19.0
diff --git a/indexer/generate-docs.sh b/indexer/generate-docs.sh
index 1007326dd..7016f5169 100755
--- a/indexer/generate-docs.sh
+++ b/indexer/generate-docs.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 docker run --rm \
   -v "${PWD}:/local" \
-  openapitools/openapi-generator-cli generate \
+  openapitools/openapi-generator-cli:v7.19.0 generate \
   -i /local/indexer_opanapi_v1.yaml \
   -g markdown \
   -o /local/docs
diff --git a/tools/bin/check_repo_clean.sh b/tools/bin/check_repo_clean.sh
new file mode 100755
index 000000000..00ead9555
--- /dev/null
+++ b/tools/bin/check_repo_clean.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Script to run repository hygiene commands and fail if they modify the repo.
+# Runs: just tidy, just mock, just generate
+# Exits non-zero and prints modified files if any step changes the working tree.
+
+# Ensure we are inside a git repository
+if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  echo "ERROR: not inside a git repository" >&2
+  exit 2
+fi
+
+# Ensure `just` is available
+if ! command -v just >/dev/null 2>&1; then
+  echo "ERROR: 'just' not found in PATH" >&2
+  exit 2
+fi
+
+run_and_check() {
+  local name="$1"; shift
+  local before
+  local after
+
+  echo "--- Running: just $* (${name}) ---"
+  before=$(git status --porcelain)
+
+  if ! just "$@"; then
+    echo "ERROR: 'just $*' failed" >&2
+    exit 1
+  fi
+
+  after=$(git status --porcelain)
+
+  if [ "${before}" != "${after}" ]; then
+    echo "\nERROR: Repository changed after 'just $*' (${name})." >&2
+    echo "Changed files (git status --porcelain):" >&2
+    git --no-pager status --porcelain >&2
+    echo "\nYou should inspect and commit or revert these changes." >&2
+    exit 1
+  fi
+
+  echo "OK: no repo changes after 'just $*' (${name}).\n"
+}
+
+# Run tasks in order
+run_and_check "mod-tidy" tidy
+run_and_check "mock" mock
+run_and_check "generate" generate
+
+echo "All checks passed: repository unchanged by tidy, mock, and generate."
+exit 0
+

From 81c33ae1009d5747b96d2fdd30791ed48dca62e7 Mon Sep 17 00:00:00 2001
From: Will Winder <wwinder.unh@gmail.com>
Date: Fri, 23 Jan 2026 14:18:38 -0500
Subject: [PATCH 2/7] Add automation.

---
 .github/workflows/repo-clean.yaml | 33 +++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/repo-clean.yaml

diff --git a/.github/workflows/repo-clean.yaml b/.github/workflows/repo-clean.yaml
new file mode 100644
index 000000000..7118662fc
--- /dev/null
+++ b/.github/workflows/repo-clean.yaml
@@ -0,0 +1,33 @@
+name: Repo Hygiene Checks
+
+on:
+  merge_group:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  mod-tidy-all:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v6 # v6
+        with:
+          cache: true
+          go-version-file: 'go.mod'
+
+      - name: Install just
+        uses: extractions/setup-just@69d82fb0233557aec017ef13706851d0694e0f1d # v2.0.0
+
+      - name: Install go-tools
+        run: just install-go-tools
+
+      - name: Run repo hygiene checks
+        run: |
+          tools/bin/check_repo_clean.sh

From 86805590758d56a115517f657f81c43250cb85b8 Mon Sep 17 00:00:00 2001
From: Will Winder <wwinder.unh@gmail.com>
Date: Fri, 23 Jan 2026 14:25:09 -0500
Subject: [PATCH 3/7] Rename

---
 .github/workflows/{repo-clean.yaml => repo-hygiene.yaml} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename .github/workflows/{repo-clean.yaml => repo-hygiene.yaml} (97%)

diff --git a/.github/workflows/repo-clean.yaml b/.github/workflows/repo-hygiene.yaml
similarity index 97%
rename from .github/workflows/repo-clean.yaml
rename to .github/workflows/repo-hygiene.yaml
index 7118662fc..d6918c381 100644
--- a/.github/workflows/repo-clean.yaml
+++ b/.github/workflows/repo-hygiene.yaml
@@ -8,7 +8,7 @@ on:
       - main
 
 jobs:
-  mod-tidy-all:
+  hygiene-checks:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code

From 1f194a9a0b358f95ca684eed2cecdb5e87cbe3b8 Mon Sep 17 00:00:00 2001
From: Will Winder <wwinder.unh@gmail.com>
Date: Fri, 23 Jan 2026 14:31:48 -0500
Subject: [PATCH 4/7] Make workflows slightly more consistent.

---
 .github/workflows/golangci-lint.yaml                  | 8 +-------
 .github/workflows/mod-tidy-all.yaml                   | 8 +-------
 .github/workflows/release-rc-publish.yaml             | 4 +---
 .github/workflows/test-nightly-performance-chaos.yaml | 4 +---
 .github/workflows/test-performance-on-demand.yaml     | 6 ++----
 .github/workflows/test-services.yaml                  | 2 --
 .github/workflows/test-smoke.yaml                     | 4 +---
 .github/workflows/test-testnets-integration.yaml      | 6 ++----
 8 files changed, 9 insertions(+), 33 deletions(-)

diff --git a/.github/workflows/golangci-lint.yaml b/.github/workflows/golangci-lint.yaml
index 995d197df..7b847bb18 100644
--- a/.github/workflows/golangci-lint.yaml
+++ b/.github/workflows/golangci-lint.yaml
@@ -17,17 +17,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Read Go version
-        id: tool_versions
-        shell: bash
-        run: |
-          echo "go_version=$(grep -E '^VERSION_GO=' tool-versions.env | cut -d= -f2)" >> $GITHUB_OUTPUT
-
       - name: Set up Go
         uses: actions/setup-go@v6 # v6
         with:
           cache: true
-          go-version: ${{ steps.tool_versions.outputs.go_version }}
+          go-version-file: 'go.mod'
 
       - name: Load tool versions
         id: tool-versions
diff --git a/.github/workflows/mod-tidy-all.yaml b/.github/workflows/mod-tidy-all.yaml
index eef880550..4c724380d 100644
--- a/.github/workflows/mod-tidy-all.yaml
+++ b/.github/workflows/mod-tidy-all.yaml
@@ -16,17 +16,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Read Go version
-        id: tool_versions
-        shell: bash
-        run: |
-          echo "go_version=$(grep -E '^VERSION_GO=' tool-versions.env | cut -d= -f2)" >> $GITHUB_OUTPUT
-
       - name: Set up Go
         uses: actions/setup-go@v6 # v6
         with:
           cache: true
-          go-version: ${{ steps.tool_versions.outputs.go_version }}
+          go-version-file: 'go.mod'
 
       - name: Populate go envs
         run: |
diff --git a/.github/workflows/release-rc-publish.yaml b/.github/workflows/release-rc-publish.yaml
index 0838be3b9..f8fa0ae68 100644
--- a/.github/workflows/release-rc-publish.yaml
+++ b/.github/workflows/release-rc-publish.yaml
@@ -19,8 +19,6 @@ jobs:
 
       - name: Install Just
         uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
-        with:
-          just-version: '1.40.0'
 
       - name: Authenticate to AWS ECR
         uses: ./.github/actions/aws-ecr-auth
@@ -40,4 +38,4 @@ jobs:
           echo "Building Release Candidate Image.."
           just "$MODULE"/build-rc
           echo "Publishing Release Candidate Image.."
-          just "$MODULE"/publish-rc "${{ secrets.ECR_REGISTRY }}" "$VERSION"
\ No newline at end of file
+          just "$MODULE"/publish-rc "${{ secrets.ECR_REGISTRY }}" "$VERSION"
diff --git a/.github/workflows/test-nightly-performance-chaos.yaml b/.github/workflows/test-nightly-performance-chaos.yaml
index 5851a31a0..642f82df5 100644
--- a/.github/workflows/test-nightly-performance-chaos.yaml
+++ b/.github/workflows/test-nightly-performance-chaos.yaml
@@ -37,8 +37,6 @@ jobs:
 
       - name: Install Just
         uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
-        with:
-          just-version: '1.40.0'
 
       - name: Authenticate to AWS ECR
         uses: ./.github/actions/aws-ecr-auth
@@ -78,4 +76,4 @@ jobs:
         env:
           LOKI_URL: http://localhost:3030/loki/api/v1/push
         run: |
-          go test -v -run ${{ matrix.test.name }} -timeout 1h
\ No newline at end of file
+          go test -v -run ${{ matrix.test.name }} -timeout 1h
diff --git a/.github/workflows/test-performance-on-demand.yaml b/.github/workflows/test-performance-on-demand.yaml
index 4abb22c64..8b3cdc5f5 100644
--- a/.github/workflows/test-performance-on-demand.yaml
+++ b/.github/workflows/test-performance-on-demand.yaml
@@ -37,8 +37,6 @@ jobs:
 
       - name: Install Just
         uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
-        with:
-          just-version: '1.40.0'
 
       - name: Authenticate to AWS ECR
         uses: ./.github/actions/aws-ecr-auth
@@ -46,7 +44,7 @@ jobs:
           role-to-assume: ${{ secrets.CCV_IAM_ROLE }}
           aws-region: us-east-1
           registry-type: public
-      
+
       - name: Authenticate to AWS ECR (JD)
         uses: ./.github/actions/aws-ecr-auth
         with:
@@ -86,4 +84,4 @@ jobs:
         env:
           LOKI_URL: http://localhost:3030/loki/api/v1/push
         run: |
-          go test -v -run ${{ matrix.test.name }} -timeout 1h
\ No newline at end of file
+          go test -v -run ${{ matrix.test.name }} -timeout 1h
diff --git a/.github/workflows/test-services.yaml b/.github/workflows/test-services.yaml
index b7a163630..08f891843 100644
--- a/.github/workflows/test-services.yaml
+++ b/.github/workflows/test-services.yaml
@@ -29,8 +29,6 @@ jobs:
 
       - name: Install Just
         uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
-        with:
-          just-version: '1.40.0'
 
       - name: Authenticate to AWS ECR
         uses: ./.github/actions/aws-ecr-auth
diff --git a/.github/workflows/test-smoke.yaml b/.github/workflows/test-smoke.yaml
index 2ccb4a32c..4fc73ed83 100644
--- a/.github/workflows/test-smoke.yaml
+++ b/.github/workflows/test-smoke.yaml
@@ -57,8 +57,6 @@ jobs:
 
       - name: Install Just
         uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
-        with:
-          just-version: '1.40.0'
 
       - name: Authenticate to AWS ECR
         uses: ./.github/actions/aws-ecr-auth
@@ -66,7 +64,7 @@ jobs:
           role-to-assume: ${{ secrets.CCV_IAM_ROLE }}
           aws-region: us-east-1
           registry-type: public
-          
+
       - name: Authenticate to AWS ECR (JD)
         uses: ./.github/actions/aws-ecr-auth
         with:
diff --git a/.github/workflows/test-testnets-integration.yaml b/.github/workflows/test-testnets-integration.yaml
index 843e1a4e0..a594e9d16 100644
--- a/.github/workflows/test-testnets-integration.yaml
+++ b/.github/workflows/test-testnets-integration.yaml
@@ -31,8 +31,6 @@ jobs:
 
       - name: Install Just
         uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
-        with:
-          just-version: '1.40.0'
 
       - name: Authenticate to AWS ECR
         uses: ./.github/actions/aws-ecr-auth
@@ -40,7 +38,7 @@ jobs:
           role-to-assume: ${{ secrets.CCV_IAM_ROLE }}
           aws-region: us-east-1
           registry-type: public
-      
+
       - name: Authenticate to AWS ECR (JD)
         uses: ./.github/actions/aws-ecr-auth
         with:
@@ -83,4 +81,4 @@ jobs:
 
       - name: Run Soak Test
         working-directory: build/devenv/tests/e2e
-        run: go test -timeout 2h -v -run TestSoak
\ No newline at end of file
+        run: go test -timeout 2h -v -run TestSoak

From fe51e9065f42850d15aa54c07c68188717bbd60f Mon Sep 17 00:00:00 2001
From: Will Winder <wwinder.unh@gmail.com>
Date: Sat, 24 Jan 2026 09:42:10 -0500
Subject: [PATCH 5/7] Run shellcheck.

---
 .github/workflows/repo-hygiene.yaml |  3 +--
 tools/bin/check_repo_clean.sh       | 18 ++++++++++--------
 tools/bin/cov_compare.sh            |  2 +-
 tools/bin/install-protoc.sh         | 12 ++++++------
 4 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/repo-hygiene.yaml b/.github/workflows/repo-hygiene.yaml
index d6918c381..970d3909c 100644
--- a/.github/workflows/repo-hygiene.yaml
+++ b/.github/workflows/repo-hygiene.yaml
@@ -29,5 +29,4 @@ jobs:
         run: just install-go-tools
 
       - name: Run repo hygiene checks
-        run: |
-          tools/bin/check_repo_clean.sh
+        run: tools/bin/check_repo_clean.sh
diff --git a/tools/bin/check_repo_clean.sh b/tools/bin/check_repo_clean.sh
index 00ead9555..8953115c1 100755
--- a/tools/bin/check_repo_clean.sh
+++ b/tools/bin/check_repo_clean.sh
@@ -18,11 +18,10 @@ if ! command -v just >/dev/null 2>&1; then
 fi
 
 run_and_check() {
-  local name="$1"; shift
   local before
   local after
 
-  echo "--- Running: just $* (${name}) ---"
+  echo "--- Running: just $* ---"
   before=$(git status --porcelain)
 
   if ! just "$@"; then
@@ -33,20 +32,23 @@ run_and_check() {
   after=$(git status --porcelain)
 
   if [ "${before}" != "${after}" ]; then
-    echo "\nERROR: Repository changed after 'just $*' (${name})." >&2
+    echo ""
+    echo "ERROR: Repository changed after 'just $*'." >&2
     echo "Changed files (git status --porcelain):" >&2
     git --no-pager status --porcelain >&2
-    echo "\nYou should inspect and commit or revert these changes." >&2
+    echo ""
+    echo "You should inspect and commit or revert these changes." >&2
     exit 1
   fi
 
-  echo "OK: no repo changes after 'just $*' (${name}).\n"
+  echo "OK: no repo changes after 'just $*'."
+  echo ""
 }
 
 # Run tasks in order
-run_and_check "mod-tidy" tidy
-run_and_check "mock" mock
-run_and_check "generate" generate
+run_and_check tidy
+run_and_check mock
+run_and_check generate
 
 echo "All checks passed: repository unchanged by tidy, mock, and generate."
 exit 0
diff --git a/tools/bin/cov_compare.sh b/tools/bin/cov_compare.sh
index 78d27746a..2aad6d2f6 100755
--- a/tools/bin/cov_compare.sh
+++ b/tools/bin/cov_compare.sh
@@ -23,7 +23,7 @@ for arg in "$@"; do
 done
 
 # Reset positional parameters
-set -- $ARGS
+set -- "$ARGS"
 
 if [ "$#" -ne 2 ]; then
   echo "Usage: $0 [--no-header] coverage1.out coverage2.out" >&2
diff --git a/tools/bin/install-protoc.sh b/tools/bin/install-protoc.sh
index 94d261e73..a0bbc66dd 100755
--- a/tools/bin/install-protoc.sh
+++ b/tools/bin/install-protoc.sh
@@ -13,7 +13,7 @@ os=$(uname)
 arch=$(uname -m)
 
 install_dir=/usr/local
-$install_dir/bin/protoc --version | grep $VERSION
+$install_dir/bin/protoc --version | grep "$VERSION"
 rc=$?
 if [ $rc -eq 0 ]; then
     # we have the current VERSION
@@ -38,12 +38,12 @@ else
 fi
 
 workdir=$(mktemp -d)
-pushd $workdir
+pushd "$workdir" || exit 1
 pb_url="https://github.com/protocolbuffers/protobuf/releases"
 artifact=protoc-$VERSION-$os-$arch.zip
-curl -LO $pb_url/download/v${VERSION}/$artifact
-unzip -o $artifact -d $install_dir
-rm $artifact
+curl -LO "$pb_url/download/v${VERSION}/$artifact"
+unzip -o "$artifact" -d "$install_dir"
+rm "$artifact"
 
 echo "protoc $VERSION installed in $install_dir"
-popd
\ No newline at end of file
+popd || exit 1

From a1a124c92be2ca9d04a66aaca842e7ffac5d334e Mon Sep 17 00:00:00 2001
From: Will Winder <wwinder.unh@gmail.com>
Date: Sat, 24 Jan 2026 15:19:41 -0500
Subject: [PATCH 6/7] Add shellcheck to checks.

---
 Justfile                      |  7 +++++++
 tools/bin/check_repo_clean.sh | 21 +++++++++++++--------
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/Justfile b/Justfile
index 683fb6b0b..197b8a992 100644
--- a/Justfile
+++ b/Justfile
@@ -51,6 +51,13 @@ fmt: ensure-golangci-lint
 lint fix="": ensure-golangci-lint
     find . -type f -name go.mod -execdir golangci-lint run {{ if fix != "" { "--fix" } else { "" } }} \;
 
+shellcheck:
+    @command -v shellcheck >/dev/null 2>&1 || { \
+        echo "shellcheck is not installed. Please install it first."; \
+        exit 1; \
+    }
+    find . -type f -name *.sh -execdir shellcheck {} +
+
 mod-download: ensure-go
     go mod download
 
diff --git a/tools/bin/check_repo_clean.sh b/tools/bin/check_repo_clean.sh
index 8953115c1..d44fa73f7 100755
--- a/tools/bin/check_repo_clean.sh
+++ b/tools/bin/check_repo_clean.sh
@@ -2,8 +2,10 @@
 set -euo pipefail
 
 # Script to run repository hygiene commands and fail if they modify the repo.
-# Runs: just tidy, just mock, just generate
-# Exits non-zero and prints modified files if any step changes the working tree.
+# Exits non-zero and prints modified files if any step fails or changes the working tree.
+
+# List of just targets to run for checks.
+just_targets_to_run=(tidy mock generate shellcheck)
 
 # Ensure we are inside a git repository
 if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
@@ -45,11 +47,14 @@ run_and_check() {
   echo ""
 }
 
-# Run tasks in order
-run_and_check tidy
-run_and_check mock
-run_and_check generate
+for c in "${just_targets_to_run[@]}"; do
+  run_and_check "$c"
+done
 
-echo "All checks passed: repository unchanged by tidy, mock, and generate."
-exit 0
+# Print a multiline bulleted list showing which just targets ran
+echo "All checks passed:"
+for t in "${just_targets_to_run[@]}"; do
+  echo "    * just $t"
+done
 
+exit 0

From 9ee3e0e59952643b16055aa3ccde6be1b811d937 Mon Sep 17 00:00:00 2001
From: Will Winder <wwinder.unh@gmail.com>
Date: Sat, 24 Jan 2026 15:23:29 -0500
Subject: [PATCH 7/7] Make checks more obvious by accepting them as an
 argument.

---
 .github/workflows/repo-hygiene.yaml | 2 +-
 tools/bin/check_repo_clean.sh       | 9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/repo-hygiene.yaml b/.github/workflows/repo-hygiene.yaml
index 970d3909c..dbb0588b9 100644
--- a/.github/workflows/repo-hygiene.yaml
+++ b/.github/workflows/repo-hygiene.yaml
@@ -29,4 +29,4 @@ jobs:
         run: just install-go-tools
 
       - name: Run repo hygiene checks
-        run: tools/bin/check_repo_clean.sh
+        run: tools/bin/check_repo_clean.sh tidy mock generate shellcheck
diff --git a/tools/bin/check_repo_clean.sh b/tools/bin/check_repo_clean.sh
index d44fa73f7..eaa484b79 100755
--- a/tools/bin/check_repo_clean.sh
+++ b/tools/bin/check_repo_clean.sh
@@ -4,9 +4,16 @@ set -euo pipefail
 # Script to run repository hygiene commands and fail if they modify the repo.
 # Exits non-zero and prints modified files if any step fails or changes the working tree.
 
-# List of just targets to run for checks.
+# Default list of just targets to run for checks (fallback).
 just_targets_to_run=(tidy mock generate shellcheck)
 
+# If the script is invoked with positional arguments, use those as the targets
+# instead of the default list. Example:
+#   ./tools/bin/check_repo_clean.sh tidy mock generate
+if [ "$#" -gt 0 ]; then
+  just_targets_to_run=("$@")
+fi
+
 # Ensure we are inside a git repository
 if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
   echo "ERROR: not inside a git repository" >&2