{
  lib,
  helpers,
}: let
  inherit (lib) toList optionalAttrs optional;
  inherit (helpers) prependToBeforeScript appendToAfterScript;
in
  {
    key,
    job,
    pipelineName,
    nixConfig,
  }:
    if ! nixConfig.enable then job else
    (builtins.removeAttrs job [ "variables" "cache" ])
    // (prependToBeforeScript [ "source setup_nix_ci \"gitlab-ci:pipeline:${pipelineName}:job-deps:${key}\"" ] job)
    // (appendToAfterScript [ "finalize_nix_ci" ] job)
    // (let
      variables = job.variables or {} //
        optionalAttrs nixConfig.enableRunnerCache {
          NIX_CI_CACHE_STRATEGY = "runner";
        };
    in
      # filter empty variables
      optionalAttrs (variables != {}) {
        inherit variables;
      })
    // (let
      cache = (toList (job.cache or [])) ++
      (optional nixConfig.enableRunnerCache {
        key = nixConfig.runnerCacheKey;
        paths = [ ".nix-cache/" ];
      });
    in
      # filter empty cache
      optionalAttrs (cache != []) {
        inherit cache;
      })