{ lib, pkgs }:
let
  # vulnix's bundled nix-2.34 broke its own --experimental-features detection
  nixConf = pkgs.writeText "ci-nix.conf" "experimental-features = nix-command flakes";
in
# tools must track ci.py's subprocess calls; nix stays ambient (uses the
# runner's own nix, not a pinned one).
pkgs.writers.writePython3Bin "ci" {
  flakeIgnore = [ "E501" ];
  libraries = [ pkgs.python3Packages.subprocess-tee ];
  makeWrapperArgs = [
    "--set-default"
    "NIX_USER_CONF_FILES"
    (toString nixConf)
    "--prefix"
    "PATH"
    ":"
    (lib.makeBinPath (
      with pkgs;
      [
        dix
        vulnix
        nixfmt
        statix
        deadnix
        reviewdog
        git
      ]
    ))
  ];
} (builtins.readFile ./ci.py)