{
  config,
  lib,
  withSystem,
  self,
  ...
}:
let
  collectFlakeOutputs =
    { config, pkgs }:
    let
      inherit (pkgs) lib;
      collectDrvs =
        prefix: attrs:
        let
          drvs = lib.pipe attrs [
            (lib.filterAttrs (_: lib.isDerivation))
            (lib.mapAttrsToList (
              name: drv: {
                name = lib.concatStringsSep "." (prefix ++ [ name ]);
                inherit drv;
              }
            ))
          ];
          recursed = lib.pipe attrs [
            (lib.filterAttrs (
              _: val: (!lib.isDerivation val) && (lib.isAttrs val) && (val.recurseForDerivations or true)
            ))
            (lib.mapAttrsToList (name: collectDrvs (prefix ++ [ name ])))
          ];
        in
        drvs ++ (lib.flatten recursed);
      rootOutputs = builtins.removeAttrs config.onPush.default.outputs [ "effects" ];
    in
    collectDrvs [ ] rootOutputs;
in
{
  defaultEffectSystem = "aarch64-linux";

  hercules-ci = {
    flake-update = {
      enable = true;
      when.dayOfWeek = "Mon";
    };
  };

  herculesCI = herculesCI: {
    onPush.default = {
      outputs.effects = {
        pin-cache = withSystem config.defaultEffectSystem (
          { pkgs, hci-effects, ... }:
          let
            collected = collectFlakeOutputs {
              inherit (herculesCI) config;
              inherit pkgs;
            };
            cachixCommands = lib.concatMapStringsSep "\n" (
              { name, drv }: "cachix pin nrabulinski ${lib.escapeShellArg name} ${lib.escapeShellArg drv}"
            ) collected;
          in
          hci-effects.runIf (herculesCI.config.repo.branch == "main") (
            hci-effects.mkEffect {
              secretsMap."cachix-token" = "cachix-token";
              inputs = [ pkgs.cachix ];
              userSetupScript = ''
                cachix authtoken $(readSecretString cachix-token .token)
              '';
              # Discarding the context is fine here because we don't actually want to build those derivations.
              # They have already been built as part of this job,
              # we only want to pin them to make sure cachix doesn't GC them.
              effectScript = builtins.unsafeDiscardStringContext cachixCommands;
            }
          )
        );
      };
    };
  };

  perSystem =
    { pkgs, lib, ... }:
    rec {
      legacyPackages.outputsList =
        let
          config = self.herculesCI {
            primaryRepo = { };
            herculesCI = { };
          };
        in
        collectFlakeOutputs { inherit config pkgs; };

      legacyPackages.github-matrix =
        let
          systems = lib.groupBy ({ drv, ... }: drv.system) legacyPackages.outputsList;
        in
        lib.concatMapStringsSep "\n" (
          { name, value }:
          ''
            ${name}=${builtins.toJSON (map (d: d.name) value)}
          ''
        ) (lib.attrsToList systems);
    };
}