Ansible vars_prompt for roles

If you look at the output from running your playbook with the vars_prompt you'll see that the fail task runs after the other roles. This is also mentioned in the Ansible docs for playbooks and roles:

If the play still has a ‘tasks’ section, those tasks are executed after roles are applied.

As the above docs also mention if you want to force a task to run before any roles then you can use pre_tasks.

So to have your confirmation style prompt you could simply do this:

- hosts: all
  vars_prompt:
    - name: CONFIRM
      prompt: Just to confirm you will install stuff
  pre_tasks:
    - fail: no deployment this time
      when: CONFIRM != 'yes'
  roles:
    - common
    - install_nginx