fix: preserve parser error for malformed trailing YAML documents

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

validate.go

@@ -3,6 +3,7 @@ package main
 import (
 	"bytes"
 	"errors"
+	"fmt"
 	"io"
 
 	"github.com/siderolabs/talos/pkg/machinery/resources/network"
@@ -28,8 +29,11 @@ func validateConfig(data []byte) error {
 		return err
 	}
 
-	if err := dec.Decode(new(any)); !errors.Is(err, io.EOF) {
+	switch err := dec.Decode(new(any)); {
+	case err == nil:
 		return errors.New("unexpected extra YAML document")
+	case !errors.Is(err, io.EOF):
+		return fmt.Errorf("unexpected extra YAML document: %w", err)
 	}
 
 	return nil

validate_test.go

@@ -83,6 +83,7 @@ func TestValidateConfigInvalid(t *testing.T) {
 		{"bad enum value", "addresses:\n  - address: 1.2.3.4/32\n    family: inet5\n"},
 		{"bad IP", "externalIPs:\n  - not-an-ip\n"},
 		{"extra document", validNetworkConfig + "---\nexternalIPs: []\n"},
+		{"malformed extra document", validNetworkConfig + "---\nkey: [\ninvalid"},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			if err := validateConfig([]byte(tt.config)); err == nil {
@@ -102,3 +103,15 @@ func TestValidateConfigUnknownFieldError(t *testing.T) {
 		t.Fatalf("error should mention the unknown field, got: %v", err)
 	}
 }
+
+func TestValidateConfigMalformedExtraDocumentError(t *testing.T) {
+	err := validateConfig([]byte(validNetworkConfig + "---\nkey: [\ninvalid"))
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+
+	// The underlying parser error must be preserved for diagnostics.
+	if !strings.Contains(err.Error(), "yaml") {
+		t.Fatalf("error should preserve the parser error, got: %v", err)
+	}
+}