{ lib, pkgs }:
# tools must track ci.py's subprocess calls; nix stays ambient (uses the
# runner's own nix, not a pinned one).
pkgs.writers.writePython3Bin "ci" {
  flakeIgnore = [ "E501" ];
  makeWrapperArgs = [
    "--prefix"
    "PATH"
    ":"
    (lib.makeBinPath (
      with pkgs;
      [
        dix
        vulnix
        nixfmt
        statix
        deadnix
        reviewdog
        git
      ]
    ))
  ];
} (builtins.readFile ./ci.py)