{
  pkgs,
  cilib,
  ntlib,
  ...
}: {
  suites."CI Lib" = {
    pos = __curPos;
    tests = let
      inherit (cilib) mkJobDeps mkJobRun mkJobPatched mkPipeline;
      deps = mkJobDeps {
        key = "test";
        job = {
          variables.TEST = "${pkgs.curl}";
        };
        nixConfig = {
          enable = true;
          deps = [pkgs.hello];
        };
      };
    in [
      {
        name = "jobDeps";
        type = "script";
        script =
          # sh
          ''
            ${ntlib.helpers.path [pkgs.gnugrep]}
            ${ntlib.helpers.scriptHelpers}
            assert_file_contains ${deps} "/nix/store" "should contain nix store path"
            assert_file_contains ${deps} '-hello-.*/bin:$PATH' "should contain hello"
            assert_file_contains ${deps} "export TEST=" "should export TEST"
            assert_file_contains ${deps} "curl" "should contain curl"
          '';
      }
      {
        name = "jobRun";
        type = "script";
        script = let
          run = mkJobRun {
            key = "test";
            job.script = ["hello"];
            jobDeps = deps;
          };
        in
          # sh
          ''
            ${ntlib.helpers.path [pkgs.gnugrep]}
            ${ntlib.helpers.scriptHelpers}
            assert_file_contains ${run}/bin/gitlab-ci-job:test "sandbox-helper" "should contain sandbox-helper"
            assert_file_contains ${run}/bin/gitlab-ci-job:test "gitlab-ci-job-test-raw" "should contain job name"
            assert_file_contains ${run.passthru.actualJobScript} "gitlab-ci-job-deps-test" "should contain job name"
            assert_file_contains ${run.passthru.actualJobScript} "Running script..." "should contain 'Running script...'"
            assert_file_contains ${run.passthru.actualJobScript} "hello" "should contain hello"
          '';
      }
      {
        name = "jobPatched nix disabled";
        expected = {};
        actual = mkJobPatched {
          key = "test";
          pipelineName = "test";
          job = {};
          nixConfig.enable = false;
        };
      }
      {
        name = "jobPatched without runner cache";
        expected = {
          after_script = ["finalize_nix_ci"];
          before_script = ["source setup_nix_ci \"gitlab-ci:pipeline:test:job-deps:test\""];
        };
        actual = mkJobPatched {
          key = "test";
          pipelineName = "test";
          job = {};
          nixConfig = {
            enable = true;
            enableRunnerCache = false;
          };
        };
      }
      {
        name = "jobPatched with runner cache";
        expected = {
          after_script = ["finalize_nix_ci"];
          before_script = ["source setup_nix_ci \"gitlab-ci:pipeline:test:job-deps:test\""];
          cache = [
            {
              key = "test";
              paths = [".nix-cache/"];
            }
          ];
          variables."NIX_CI_CACHE_STRATEGY" = "runner";
        };
        actual = mkJobPatched {
          key = "test";
          pipelineName = "test";
          job = {};
          nixConfig = {
            enable = true;
            enableRunnerCache = true;
            runnerCacheKey = "test";
          };
        };
      }
      {
        name = "mkPipeline empty";
        expected = {};
        actual =
          (mkPipeline {
            name = "test";
            nixConfig = {};
            pipeline.jobs = {};
          }).finalConfig;
      }
      {
        name = "mkPipeline empty packages";
        type = "script";
        script = let
          pipeline =
            ntlib.helpers.toJsonFile
            (mkPipeline {
              name = "test";
              nixConfig = {};
              pipeline.jobs = {};
            }).packages;
        in
          # sh
          ''
            set -euo pipefail
            ${ntlib.helpers.path [pkgs.jq pkgs.gnugrep pkgs.coreutils]}
            echo "two keys, one json one pretty"
            jq 'keys | length == 2' "${pipeline}" | grep -q true
            echo "key[0] is exactly 'gitlab-ci:pipeline:test'"
            jq -r 'keys[0]' "${pipeline}" | grep -qx "gitlab-ci:pipeline:test"
            echo "key[1] is exactly 'gitlab-ci:pipeline:test:pretty'"
            jq -r 'keys[1]' "${pipeline}" | grep -qx "gitlab-ci:pipeline:test:pretty"
            echo "value contains '/nix/store/'"
            jq -r '.["gitlab-ci:pipeline:test"]' "${pipeline}" | grep -q "/nix/store/"
            echo "value contains 'gitlab-ci-test.yml'"
            jq -r '.["gitlab-ci:pipeline:test"]' "${pipeline}" | grep -q "gitlab-ci-test.yml"
            echo "file only contains '{}'"
            [[ "$(cat $(jq -r '.["gitlab-ci:pipeline:test"]' "${pipeline}"))" == "{}" ]]
          '';
      }
      {
        name = "handle store paths in variables";
        expected = {
          stages = ["test"];
          test.stage = "test";
        };
        actual =
          (mkPipeline {
            name = "test";
            nixConfig.enable = false;
            pipeline = {
              stages = ["test"];
              jobs.test = {
                stage = "test";
                variables."TEST" = "${pkgs.hello}";
              };
            };
          }).finalConfig;
      }
    ];
  };
}