{
  system ? builtins.currentSystem,
  sources ? import ./npins,
  pkgs ? import sources.nixpkgs { inherit system; },
}:
let
  inherit (sources)
    nixpkgs
    git-hooks
    gitignore
    ;
  inherit (pkgs) lib;
  pre-commit-check =
    (import "${git-hooks}/nix" {
      inherit nixpkgs system;
      gitignore-nix-src = {
        lib = import gitignore { inherit lib; };
      };
    }).run
      {
        src = builtins.path {
          path = ./.;
          name = "source";
        };
        hooks =
          let
            ## Add a directory here if pre-commit hooks shouldn't apply to it.
            optout = [
              "npins"
            ];
            excludes = map (dir: "^${dir}/") optout;
            addExcludes = lib.mapAttrs (_: c: c // { inherit excludes; });
          in
          addExcludes {
            nixfmt-rfc-style.enable = true;
            deadnix.enable = true;
            trim-trailing-whitespace.enable = true;
            shellcheck.enable = true;
          };
      };
in
{
  # shell for testing TF directly
  shell = pkgs.mkShellNoCC {
    inherit (pre-commit-check) shellHook;
    buildInputs = pre-commit-check.enabledPackages;
  };

  tests = {
    inherit pre-commit-check;
  };

  # re-export inputs so they can be overridden granularly
  # (they can't be accessed from the outside any other way)
  inherit
    sources
    system
    pkgs
    ;
}