feat(validation): refuse a variable declared by two input specs

plugins/action/validate_inputs.py

@@ -110,10 +110,14 @@ class ActionModule(ActionBase):
         result = super().run(tmp, task_vars)
         task_vars = task_vars or {}
         validator = _Validator(self._templar)
+        declared = {}
         for path in self._task.args["specs"]:
             options = self._loader.load_from_file(path)["argument_specs"]["inputs"]["options"]
             _check_spec(options, path)
             for name, spec in options.items():
+                if name in declared:
+                    raise AnsibleError(f"{name} is declared by both {declared[name]} and {path}")
+                declared[name] = path
                 if name in task_vars:
                     validator.check(spec, task_vars[name], name)
                 elif spec.get("required"):

tests/inputs/test_inputs.yml

@@ -14,6 +14,26 @@
         loop_var: inf
         label: "{{ inf.name }}"
 
+    - name: Refuse a variable declared by two specs
+      block:
+        - name: Run the validator with the fixture spec twice
+          validate_inputs:
+            specs:
+              - "{{ playbook_dir }}/fixture_spec.yml"
+              - "{{ playbook_dir }}/fixture_spec.yml"
+          register: inputs_duplicate_result
+      rescue:
+        - name: Keep the duplicate-declaration failure
+          ansible.builtin.set_fact:
+            inputs_duplicate_result: "{{ ansible_failed_result }}"
+
+    - name: Assert the duplicate declaration was refused
+      ansible.builtin.assert:
+        that:
+          - inputs_duplicate_result.msg is search('fixture is declared by both')
+        fail_msg: "[inputs duplicate] got {{ inputs_duplicate_result.msg | default('') }}"
+        success_msg: "[inputs duplicate] OK"
+
     - name: Validate a host var holding values that cannot be decrypted
       block:
         - name: Run the validator on the vaulted host var