fix(scripts): gate nixpkgs-unstable input updates on the Hydra channel (cached) revision #4553

Problem

scripts/update-nixpkgs-inputs.py updates the nixpkgs inputs to branch HEAD (nix flake update --refresh). For the nixos-unstable ref set that is the wrong target: branch HEAD runs days ahead of what Hydra has built and what cache.nixos.org actually serves. An update can therefore pin a revision whose binaries do not exist in the cache yet, turning the next system build into a massive source build.

This is not hypothetical: the 2026-10-30 update pinned nixpkgs-unstable at 31ecbaca before Hydra had built it, and the amd toplevel became a multi-day source build (55k derivations, thin cache coverage). See #2715 and PR #4519 for the full fallout, including the temporary overrides that had to be bisected and pinned on top of that update.

Fix: gate the unstable ref set on the Hydra channel revision

For every input whose original.ref is nixos-unstable (currently nixpkgs-unstable and nixpkgs-25), the update target is no longer branch HEAD. It is the newest revision Hydra has fully built for the channel:

1. GET https://hydra.nixos.org/job/nixos/unstable/tested/latest-finished (JSON, follow redirects; jobset nixos:unstable, renamed from nixos:trunk-combined) → take jobsetevals[0].
2. GET https://hydra.nixos.org/eval/<id> (JSON) → target revision is jobsetevalinputs.nixpkgs.revision.
3. Pin each gated input to that revision in flake.lock: rewrite its locked entry (rev + narHash + lastModified taken from a real nix fetch of that exact revision, e.g. nix flake metadata github:NixOS/nixpkgs/<rev>) while leaving its original entry untouched, so original.ref stays nixos-unstable and input discovery (this script and nix/nixpkgs-inputs.nix) keeps matching.
4. If an input is already at the Hydra revision, the run is a clean no-op for it and says so.

Verified live 2026-11-02: latest-finished build 351844113 (finished, status 0), eval 1830926, revision 0bb2eedc20e4739f29e8045034f2828ad7054f8f — which is exactly the revision the 2026-11-02 scheduled update run converged on by hand.

Dead ends, do not use: channels.nixos.org/<channel>/git-rev returns 404; NixOS/nixpkgs-channels has been untouched since 2021.

Fail closed

If the Hydra lookups fail, time out, or return an unexpected shape (missing fields, a revision that is not a full 40-char commit hash), the script exits non-zero with a clear message and leaves flake.lock untouched. No update is better than an uncached update.

Scope

• Only the nixos-unstable ref set is gated. The master / no-ref set keeps its current branch-HEAD behavior (the fleet procedure does not run it, and nixpkgs-master is being removed per nixpkgs: drop the nixpkgs-master input — amd should draw only from nixos-unstable (Drew directive) #3327 — its semantics are not changed here).
• This changes the updater script only; it does not move any pins on main by itself.

Acceptance criteria

• For every input whose original.ref is nixos-unstable, scripts/update-nixpkgs-inputs.py pins the Hydra channel revision (latest-finished nixos:unstable tested eval's nixpkgs revision) instead of branch HEAD, rewriting only the locked entry (rev/narHash/lastModified from a real fetch) and leaving original untouched.
• An input already at the Hydra revision is a clean no-op and the run says so.
• On any Hydra lookup failure, timeout, or unexpected response shape, the script exits non-zero with a clear message and leaves flake.lock unchanged (fail closed).
• Non-unstable inputs keep the existing branch-HEAD update behavior.