feat(validation): read a raw option with options as a bool-or-dict toggle

plugins/action/validate_inputs.py

@@ -3,7 +3,9 @@
 Each spec file's ``argument_specs.inputs.options`` declares top-level variables. Every one the host
 defines is checked without Ansible's lenient coercion: a string is never a list, bool or dict. A dict
 option whose only sub-option is a placeholder such as ``<name>`` is a collection keyed by name; each
-entry is checked against that sub-option, and a null entry means the entry is not managed. Messages name the key path
+entry is checked against that sub-option, and a null entry means the entry is not managed. A ``raw``
+option that declares ``options`` is a role toggle: ``true``, ``false``, or the dict those options
+describe. Messages name the key path
 and the types involved but never a value, so secrets cannot leak into job output.
 """
 
@@ -72,6 +74,9 @@ class _Validator:
         if value is UNRESOLVED:
             return
         kind = spec.get("type", "str")
+        if kind == "raw" and "options" in spec and not isinstance(value, (bool, Mapping)):
+            self.errors.append(f"{path}: expected bool or dict, got {_kind(value)}")
+            return
         if not TYPES[kind](value):
             self.errors.append(f"{path}: expected {kind}, got {_kind(value)}")
             return