fix(validation): refuse a specs argument that is not a list

plugins/action/validate_inputs.py

@@ -117,7 +117,10 @@ class ActionModule(ActionBase):
         paths = []
         # A pattern (`.../*/roles/*/meta/argument_specs.yml`) picks up every role's spec without a list
         # to keep in sync; one that matches nothing is a broken path, not an empty set.
-        for entry in self._task.args["specs"]:
+        specs = self._task.args["specs"]
+        if not isinstance(specs, list):
+            raise AnsibleError(f"specs must be a list of spec file paths, got {type(specs).__name__}")
+        for entry in specs:
             matches = sorted(glob.glob(entry)) if glob.has_magic(entry) else [entry]
             if not matches:
                 raise AnsibleError(f"no spec file matches {entry}")

tests/inputs/test_inputs.yml

@@ -49,6 +49,24 @@
         fail_msg: "[inputs no-match] got {{ inputs_nomatch_result.msg | default('') }}"
         success_msg: "[inputs no-match] OK"
 
+    - name: Refuse a spec list given as a string
+      block:
+        - name: Run the validator with specs as a string
+          validate_inputs:
+            specs: "{{ playbook_dir }}/fixture_spec.yml"
+          register: inputs_string_result
+      rescue:
+        - name: Keep the string-specs failure
+          ansible.builtin.set_fact:
+            inputs_string_result: "{{ ansible_failed_result }}"
+
+    - name: Assert the string was refused
+      ansible.builtin.assert:
+        that:
+          - inputs_string_result.msg is search('specs must be a list')
+        fail_msg: "[inputs string] got {{ inputs_string_result.msg | default('') }}"
+        success_msg: "[inputs string] OK"
+
     - name: Refuse a variable declared by two specs
       block:
         - name: Run the validator with the fixture spec twice