{
  sources ? import ./npins,
  pkgs ? import sources.nixpkgs { },
}:

let
  inherit (pkgs) lib mkShell;

  inherit (pkgs.lib.fileset) gitTracked toSource;

  git-checks = (import sources.git-hooks).run {
    src = ./.;

    hooks = {
      statix = {
        enable = true;
        stages = [ "pre-push" ];
        settings.ignore = [ "npins" ];
      };

      deadnix = {
        enable = true;
        stages = [ "pre-push" ];
      };

      nixfmt-rfc-style = {
        enable = true;
        stages = [ "pre-push" ];
      };

      commitizen.enable = true;
    };
  };
in

{
  devShell = mkShell {
    name = "nix-actions.dev";

    inherit (git-checks) shellHook;
  };

  install =
    { src, ... }@config:
    let
      project = lib.evalModules {
        modules = [
          ./modules
          {
            config = (removeAttrs config [ "src" ]) // {
              _module.args.pkgs = pkgs;
              rootSrc = toSource {
                root = src;
                fileset = gitTracked src;
              };
            };
          }
        ];
      };
    in
    {
      shellHook = project.config.installationScript;
    };

  lib = rec {
    expr = repr: "\${{ ${repr} }}";
    secret = name: expr "secrets.${name}";
  };

  steps =
    {
      __functor =
        self:
        {
          name,
          url,
          defaultVersion,
        }:
        self
        // {
          ${name} =
            {
              __version ? defaultVersion,
              ...
            }@args:
            {
              uses = "${url}@${__version}";
              "with" = builtins.removeAttrs args [ "__version" ];
            };
        };
    }
      {
        name = "checkout";
        defaultVersion = "v3";
        url = "actions/checkout";
      };
}