{ pkgs }:
let
  terraform = pkgs.terraform.withPlugins (p: [
    p.buildkite
    p.google
  ]);
in
pkgs.stdenv.mkDerivation rec {
  name = "tf-buildkite";
  src = ./.;

  upload = pkgs.writeShellScriptBin "tf-buildkite-upload" ''
    set -ueo pipefail

    cd $(git rev-parse --show-toplevel)/ops/buildkite

    export BUILDKITE_API_TOKEN=$(pass api/buildkite-terraform-token)

    ${terraform}/bin/terraform init
    ${terraform}/bin/terraform plan
    ${terraform}/bin/terraform apply
  '';
}