From d0916e5d2b028351829e1288ad9ee4336931cc70 Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Mon, 5 Oct 2026 18:12:41 +0200
Subject: [PATCH] feat(validation): check the contents of a raw option that
 holds a dict or list

---
 plugins/action/validate_inputs.py |  6 ++++--
 tests/inputs/fixture_spec.yml     |  5 +++++
 tests/inputs/inputs_fixtures.yml  | 20 ++++++++++++++++++--
 3 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/plugins/action/validate_inputs.py b/plugins/action/validate_inputs.py
index dccc060..b2b19d2 100644
--- a/plugins/action/validate_inputs.py
+++ b/plugins/action/validate_inputs.py
@@ -79,9 +79,11 @@ class _Validator:
         if "choices" in spec and value not in spec["choices"]:
             shown = "" if spec.get("no_log") else f", got {value!r}"
             self.errors.append(f"{path}: must be one of {', '.join(map(str, spec['choices']))}{shown}")
-        if kind == "dict" and "options" in spec:
+        # Keyed on the value, not the declared type, so a `raw` option ("false, or a dict of...") is
+        # still checked whenever it holds a dict or a list.
+        if "options" in spec and isinstance(value, Mapping):
             self.check_options(spec["options"], value, path)
-        elif kind == "list" and "elements" in spec:
+        elif "elements" in spec and isinstance(value, list):
             element = {"type": spec["elements"]}
             if "options" in spec:
                 element["options"] = spec["options"]
diff --git a/tests/inputs/fixture_spec.yml b/tests/inputs/fixture_spec.yml
index 9c83490..5b8938d 100644
--- a/tests/inputs/fixture_spec.yml
+++ b/tests/inputs/fixture_spec.yml
@@ -21,6 +21,11 @@ argument_specs:
           secret:
             type: str
             no_log: true
+          gate:
+            type: raw
+            options:
+              port:
+                type: int
           disks:
             type: list
             elements: dict
diff --git a/tests/inputs/inputs_fixtures.yml b/tests/inputs/inputs_fixtures.yml
index a3198e6..6af2cec 100644
--- a/tests/inputs/inputs_fixtures.yml
+++ b/tests/inputs/inputs_fixtures.yml
@@ -39,7 +39,7 @@ inputs_fixtures:
     value:
       name: web01
       userz: {}
-    expect: ["fixture.userz: unsupported key, fixture accepts count, disks, enabled, kind, name, secret, servers, users"]
+    expect: ["fixture.userz: unsupported key, fixture accepts count, disks, enabled, gate, kind, name, secret, servers, users"]
 
   - name: wrong-element-type
     value:
@@ -84,5 +84,21 @@ inputs_fixtures:
       enabled: "true"
       userz: {}
     expect:
-      - "fixture.userz: unsupported key, fixture accepts count, disks, enabled, kind, name, secret, servers, users"
+      - "fixture.userz: unsupported key, fixture accepts count, disks, enabled, gate, kind, name, secret, servers, users"
       - "fixture.enabled: expected bool, got str"
+
+  - name: raw-gate-false
+    value:
+      name: web01
+      gate: false
+    expect: []
+
+  - name: raw-gate-dict-checked
+    value:
+      name: web01
+      gate:
+        port: http
+        portz: 1
+    expect:
+      - "fixture.gate.portz: unsupported key, fixture.gate accepts port"
+      - "fixture.gate.port: expected int, got str"