From b6620260d5a50b6f5626e4a4492d3de954e83096 Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Mon, 5 Oct 2026 18:50:09 +0200
Subject: [PATCH] fix(validation): refuse a specs argument that is not a list

---
 plugins/action/validate_inputs.py |  5 ++++-
 tests/inputs/test_inputs.yml      | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/plugins/action/validate_inputs.py b/plugins/action/validate_inputs.py
index 2c24e3b..86dd5bd 100644
--- a/plugins/action/validate_inputs.py
+++ b/plugins/action/validate_inputs.py
@@ -117,7 +117,10 @@ class ActionModule(ActionBase):
         paths = []
         # A pattern (`.../*/roles/*/meta/argument_specs.yml`) picks up every role's spec without a list
         # to keep in sync; one that matches nothing is a broken path, not an empty set.
-        for entry in self._task.args["specs"]:
+        specs = self._task.args["specs"]
+        if not isinstance(specs, list):
+            raise AnsibleError(f"specs must be a list of spec file paths, got {type(specs).__name__}")
+        for entry in specs:
             matches = sorted(glob.glob(entry)) if glob.has_magic(entry) else [entry]
             if not matches:
                 raise AnsibleError(f"no spec file matches {entry}")
diff --git a/tests/inputs/test_inputs.yml b/tests/inputs/test_inputs.yml
index a8bf821..ea129ed 100644
--- a/tests/inputs/test_inputs.yml
+++ b/tests/inputs/test_inputs.yml
@@ -49,6 +49,24 @@
         fail_msg: "[inputs no-match] got {{ inputs_nomatch_result.msg | default('') }}"
         success_msg: "[inputs no-match] OK"
 
+    - name: Refuse a spec list given as a string
+      block:
+        - name: Run the validator with specs as a string
+          validate_inputs:
+            specs: "{{ playbook_dir }}/fixture_spec.yml"
+          register: inputs_string_result
+      rescue:
+        - name: Keep the string-specs failure
+          ansible.builtin.set_fact:
+            inputs_string_result: "{{ ansible_failed_result }}"
+
+    - name: Assert the string was refused
+      ansible.builtin.assert:
+        that:
+          - inputs_string_result.msg is search('specs must be a list')
+        fail_msg: "[inputs string] got {{ inputs_string_result.msg | default('') }}"
+        success_msg: "[inputs string] OK"
+
     - name: Refuse a variable declared by two specs
       block:
         - name: Run the validator with the fixture spec twice