.sign function which seems to give the same result when signing the same message. That means the
k param is constant. Doesn't that mean signing different messages exposes the private key? If that is the case, how can I correctly sign several messages with the same private key?
ECDSA is using deterministic k value generation as per RFC6979.
This means that every time you sign the same message you'll get the same random value used. That explains why you see the same $k$ param both times.
However, the $k$ value generation process takes the message (or the message hash) as an input. More specifically, $k$ is generated by hashing the message (hash) along with the private key. So every different message will produce a different $k$ value (apart from the negligible probability of hash collisions), and the same message will produce the same $k$ value every time it's signed.
Using the same random value with the same message is not a security risk (obviously, you just get the same signature). If you use the same random value with different messages you immediately reveal the private key, so as you note this should not be done. However, the RFC 6979 approach "ensures" that with extremely high probability different messages will use different ks.