puppet: Use --detailed-exitcodes to return nonzero exit code on failure.

Apparently, puppet has messed up exit codes and doesn't by default
return the usual 0=success, nonzero=failure codes.  By default, it
seems to always return 0; and with `--detailed-exitcodes`, it returns
the complicated thing documented in the comments.

We fix this by checking the exit code and translating it to what we
actually care about, namely whether errors occurred.

See https://tickets.puppetlabs.com/browse/PUP-2754 for details.

Fixes #1094.

scripts/zulip-puppet-apply

@@ -1,5 +1,6 @@
 #!/usr/bin/env python
 
+from __future__ import print_function
 import sys
 import subprocess
 import six.moves.configparser
@@ -26,18 +27,20 @@ for pclass in re.split(r'\s*,\s*', config.get('machine', 'puppet_classes')):
 puppet_cmd = ["puppet", "apply", "--modulepath=/root/zulip/puppet", "-e", puppet_config]
 puppet_cmd += extra_args
 
-if force:
-    subprocess.check_call(puppet_cmd)
-    sys.exit(0)
+if not force:
+    subprocess.check_call(puppet_cmd + ['--noop', '--show_diff'])
 
-subprocess.check_call(puppet_cmd + ['--noop', '--show_diff'])
+    do_apply = None
+    while do_apply != 'y':
+        sys.stdout.write("Apply changes? [y/N] ")
+        do_apply = sys.stdin.readline().strip().lower()
+        if do_apply == '' or do_apply == 'n':
+            sys.exit(0)
 
-do_apply = None
-while not (do_apply == 'y' or do_apply == 'n'):
-    sys.stdout.write("Apply changes? [y/N] ")
-    do_apply = sys.stdin.readline().strip().lower()
-    if do_apply == '':
-        do_apply = 'n'
-
-if do_apply == 'y':
-    subprocess.check_call(puppet_cmd)
+ret = subprocess.call(puppet_cmd + ['--detailed-exitcodes'])
+# ret = 0 => no changes, no errors
+# ret = 2 => changes, no errors
+# ret = 4 => no changes, yes errors
+# ret = 6 => changes, yes errors
+if ret != 0 and ret != 2:
+    sys.exit(1)