Report enrollment failures with stage and exit status

test_enroll.py

@@ -261,9 +261,47 @@ id() { if [[ $1 == -u ]]; then echo 1000; else return 0; fi; }
     def test_install_failure_stops_and_cleans_secrets(self):
         r = self.run_worker(1, 1, failure=True)
         self.assertNotEqual(r.returncode, 0)
+        self.assertIn('APT-Grundpakete (Status 42, Worker-Zeile', r.stderr)
         self.assertNotIn('TAILSCALE up', r.stdout)
         self.assertNotIn('MARK hold', r.stdout)
 
+    def test_deployment_reports_worker_and_cleanup_failure_separately(self):
+        lib = SOURCE.rsplit('\nmain\n', 1)[0]
+        lib = lib.replace('set -Eeuo pipefail', 'set -Eeo pipefail', 1)
+        lib = lib.replace("[[ $EUID == 0 ]] || fail 'Bitte auf dem Proxmox-Host als root starten.'", ':')
+        lib = lib.replace('for tool in pct timeout python3; do command -v "$tool" >/dev/null || fail "$tool fehlt auf dem Host."; done', ':')
+        mocks = r'''
+TS[144]=1; WZ[144]=0; TUN[144]=1; NAMES[144]=fixture
+TMP=/fixture; MANAGER=manager.example.com; VERSION=4.14.8-1
+pct() {
+  case "$1" in
+    status) echo 'status: running';;
+    config) echo 'hostname: fixture';;
+    push) return 0;;
+    exec)
+      case "$4" in
+        mktemp) echo /run/lxc-enroll.Fixture1;;
+        bash) echo 'Wazuh connected; SSH enabled'; [[ $MOCK_STEP != worker ]] || return 23;;
+        rm) [[ $MOCK_STEP != cleanup ]] || return 17;;
+        *) return 99;;
+      esac;;
+    *) return 99;;
+  esac
+}
+if deploy_one 144; then echo SUCCESS; else echo FAILED; fi
+'''
+        for step, status, label in (('worker', 23, 'Einrichtung im Container'),
+                                    ('cleanup', 17, 'Temporaere Dateien entfernen'),
+                                    ('none', 0, '')):
+            r = bash(lib + '\nMOCK_STEP=' + step + '\n' + mocks)
+            self.assertEqual(r.returncode, 0, r.stderr)
+            if status:
+                self.assertIn('FAILED', r.stdout)
+                self.assertIn(f'LXC 144: {label} fehlgeschlagen (Status {status}).', r.stderr)
+            else:
+                self.assertIn('SUCCESS', r.stdout)
+                self.assertEqual(r.stderr, '')
+
     def test_public_source_has_no_site_specific_values(self):
         for forbidden in ('faboi.de', '192.168.', '10.10.', 'tskey-auth-', 'hskey-auth-'):
             self.assertNotIn(forbidden, SOURCE)