core: EvalApplyProvisioners correct handling of errors

The error handling here is a bit tricky due to the ability for users to
opt out of aborting on error. It's important that we keep straight the
distinction between applyDiags and diags so we can tell the difference
between the errors from _this_ provisioner and the errors for the entire
run so far.

terraform/context_apply_test.go

@@ -5151,7 +5151,7 @@ func TestContext2Apply_provisionerDestroyFailContinueFail(t *testing.T) {
 
 	state, diags := ctx.Apply()
 	if diags == nil {
-		t.Fatal("should error")
+		t.Fatal("apply succeeded; wanted error from second provisioner")
 	}
 
 	checkStateString(t, state, `

terraform/eval_apply.go

@@ -469,12 +469,18 @@ func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*configs.Provisio
 			return h.PostProvisionInstanceStep(absAddr, prov.Type, applyDiags.Err())
 		})
 
-		if diags.HasErrors() {
-			switch prov.OnFailure {
-			case configs.ProvisionerOnFailureContinue:
+		switch prov.OnFailure {
+		case configs.ProvisionerOnFailureContinue:
+			if applyDiags.HasErrors() {
 				log.Printf("[WARN] Errors while provisioning %s with %q, but continuing as requested in configuration", n.Addr, prov.Type)
-			default:
+			} else {
+				// Maybe there are warnings that we still want to see
 				diags = diags.Append(applyDiags)
+			}
+		default:
+			diags = diags.Append(applyDiags)
+			if applyDiags.HasErrors() {
+				log.Printf("[WARN] Errors while provisioning %s with %q, so aborting", n.Addr, prov.Type)
 				return diags.Err()
 			}
 		}

terraform/test-fixtures/apply-provisioner-destroy-fail/main.tf

@@ -1,14 +1,14 @@
 resource "aws_instance" "foo" {
-    foo = "bar"
+  foo = "bar"
 
-    provisioner "shell" {
-        command  = "one"
-        when = "destroy"
-        on_failure = "continue"
-    }
+  provisioner "shell" {
+    command    = "one"
+    when       = "destroy"
+    on_failure = "continue"
+  }
 
-    provisioner "shell" {
-        command  = "two"
-        when = "destroy"
-    }
+  provisioner "shell" {
+    command = "two"
+    when    = "destroy"
+  }
 }