From 73136b7ebbf2cb181d2cdfca68fc53d1af0b20e7 Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Mon, 5 Oct 2026 18:08:55 +0200
Subject: [PATCH] feat(validation): refuse a variable declared by two input
 specs

---
 plugins/action/validate_inputs.py |  4 ++++
 tests/inputs/test_inputs.yml      | 20 ++++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/plugins/action/validate_inputs.py b/plugins/action/validate_inputs.py
index e31f987..309a512 100644
--- a/plugins/action/validate_inputs.py
+++ b/plugins/action/validate_inputs.py
@@ -110,10 +110,14 @@ class ActionModule(ActionBase):
         result = super().run(tmp, task_vars)
         task_vars = task_vars or {}
         validator = _Validator(self._templar)
+        declared = {}
         for path in self._task.args["specs"]:
             options = self._loader.load_from_file(path)["argument_specs"]["inputs"]["options"]
             _check_spec(options, path)
             for name, spec in options.items():
+                if name in declared:
+                    raise AnsibleError(f"{name} is declared by both {declared[name]} and {path}")
+                declared[name] = path
                 if name in task_vars:
                     validator.check(spec, task_vars[name], name)
                 elif spec.get("required"):
diff --git a/tests/inputs/test_inputs.yml b/tests/inputs/test_inputs.yml
index 384ebfd..1663b34 100644
--- a/tests/inputs/test_inputs.yml
+++ b/tests/inputs/test_inputs.yml
@@ -14,6 +14,26 @@
         loop_var: inf
         label: "{{ inf.name }}"
 
+    - name: Refuse a variable declared by two specs
+      block:
+        - name: Run the validator with the fixture spec twice
+          validate_inputs:
+            specs:
+              - "{{ playbook_dir }}/fixture_spec.yml"
+              - "{{ playbook_dir }}/fixture_spec.yml"
+          register: inputs_duplicate_result
+      rescue:
+        - name: Keep the duplicate-declaration failure
+          ansible.builtin.set_fact:
+            inputs_duplicate_result: "{{ ansible_failed_result }}"
+
+    - name: Assert the duplicate declaration was refused
+      ansible.builtin.assert:
+        that:
+          - inputs_duplicate_result.msg is search('fixture is declared by both')
+        fail_msg: "[inputs duplicate] got {{ inputs_duplicate_result.msg | default('') }}"
+        success_msg: "[inputs duplicate] OK"
+
     - name: Validate a host var holding values that cannot be decrypted
       block:
         - name: Run the validator on the vaulted host var