feat: pull request mirroring for GitLab, Bitbucket, Azure DevOps, and CodeCommit (#46)

* refactor(vcs): split reopen from close, add BaseSHA to review comments

Bitbucket Cloud has no reopen endpoint and CodeCommit forbids the CLOSED to
OPEN transition, so reopening cannot be part of the writer contract every
destination satisfies. PullRequestWriter now closes only, and reopening is
an optional PullRequestReopener a destination may implement. A destination
without it records the divergence and leaves the pull request closed rather
than opening a second one for the same work.

GitLab requires base, head, and start SHAs to anchor an inline comment, and
CodeCommit requires a before and after commit id, so ReviewComment carries
BaseSHA alongside CommitSHA. GitHub and Bitbucket ignore it.

* feat(gitlab): mirror merge requests, notes, and approvals

* feat(bitbucket): mirror pull requests, comments, and participant verdicts

* feat(azuredevops): mirror pull requests, threads, and reviewer votes

* feat(codecommit): mirror pull requests, comments, and approvals

* feat(gitsync): pull request mirroring for every provider type

docs: what each provider cannot represent

* fix(prsync): stop updating a closed destination pull request

A destination that cannot reopen, which is Bitbucket and CodeCommit, fell
through to UpdatePullRequest on a pull request it had just decided to leave
closed. Both providers reject an update to a closed pull request, so the
call errored before the divergence was ever recorded: the warning fired
every run, a failure was appended every run, and the mirror never settled.
The same path ran for a merged source whose destination was already closed
whenever new activity advanced its timestamp.

An update now runs only while the destination is open, and an unfixable
divergence records itself and returns.

A recorded divergence is also re-checked each run rather than trusted, so a
destination somebody reopened by hand is picked back up; previously the
marker made statesAgree return true forever and the pull request could
never be closed again.

A source that reports no update timestamp, which Azure DevOps does not, is
no longer watermarked. Skipping on a zero time mirrored such a pull request
once and then froze it: no title, body, comment, or verdict change ever
reached the destination again.

* fix(vcs): correct provider defects found in review of #46

CodeCommit's pull request cache outlived the run that filled it. A provider
is built once and reused for every cron tick, so a CodeCommit source served
the first run's snapshot forever: later pull requests were never mirrored,
closed ones never closed, and the repository was skipped as unchanged
because the same stale set fed the fingerprint. The listing now
re-enumerates and the cache only serves the finds that follow it.

CodeCommit's FindPullRequest searched open pull requests only, so a
destination pull request somebody had closed was invisible and a lost state
file produced a second one for the same branch. A missed lookup now
enumerates the closed ones too.

CodeCommit treated every failure to post a located comment as a rejected
anchor, so throttling or an expired credential permanently downgraded the
comment to a discussion comment. Only genuine location errors downgrade.

CodeCommit's ListReviews answered "no reviews" when the underlying call
failed, and the caller deletes mirrored comments it no longer sees at the
source, so one throttled call deleted every mirrored verdict. It returns
the error now.

Azure DevOps stood the creation date in for a missing update timestamp,
which froze the engine's watermark and mirrored each pull request exactly
once. It reports no timestamp instead, and the engine reconciles every run.

Azure DevOps added labels and never removed them, re-POSTing every label on
every run and failing the pull request when one already existed. Labels are
reconciled against the source, and truncation counts characters rather than
bytes so a non-ASCII description is neither cut to a third of the limit nor
split through a rune.

GitLab decided a comment was on the left side by testing an empty path, but
GitLab populates new_path on both sides of a text diff, so every deleted
line comment anchored to line 0 on the right. It tests the line instead.
GitLab's transient locked state is no longer read as closed, which used to
close the destination and post "closed without merging" moments before the
source became merged.

Bitbucket omitted draft on update, so a pull request that left draft at the
source stayed a draft at the destination, and its lookup missed superseded
pull requests.

GitHub never reported a base SHA, so every inline comment mirrored to
GitLab or CodeCommit, which both require one, silently downgraded to a
discussion comment.

Turning comments or reviews off deleted everything previously mirrored in
that category, because nothing in it appeared in the seen set. Deletion is
now scoped to categories the run actually listed.

---------

Co-authored-by: Anmol Nagpal <ianmolnagpal@gmail.com>

Author: clouddrove-ci

CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Pull request mirroring now works for every provider type, in any direction: GitLab, Bitbucket Cloud, Azure DevOps, and AWS CodeCommit join GitHub. Each maps onto the same model, and the runbook carries a table of what each provider cannot represent
+- CodeCommit is in scope after all. It was excluded when the work was planned on the grounds that it had no pull request API worth mirroring, which was wrong: it has a full one, already present in the pinned SDK, and AWS returned the service to general availability on 2025-11-24 after closing it to new customers in 2024
+
+### Changed
+- `vcs.PullRequestSpec` carries `SyncLabels`, so a provider can tell "the source has no labels", where a destination label should be removed, from "label mirroring is off", where a label somebody added at the destination must be left alone. Labels are now reconciled rather than only added: one removed at the source is removed at the destination
+- `vcs.PullRequestWriter` closes a pull request but no longer reopens one. Bitbucket Cloud has no reopen endpoint and CodeCommit permits only the `OPEN` to `CLOSED` transition, so reopening is now an optional `vcs.PullRequestReopener` capability. A destination that lacks it leaves the pull request closed, warns once, and records the divergence rather than opening a second pull request for the same work or retrying on every run
+- `vcs.ReviewComment` carries `BaseSHA` alongside `CommitSHA`: GitLab refuses to anchor an inline comment without base, head, and start SHAs, and CodeCommit needs a before and after commit id. A source that cannot supply them downgrades the comment to a discussion comment rather than dropping it
+
 ## [0.2.0] - 2026-08-19
 
 ### Added

README.md

@@ -380,7 +380,7 @@ export SYNCERD_GIT_GL_TOKEN=your-gitlab-token
 
 **Pull request heads (opt in):** set `pull_requests.enabled: true` on a mirror and the commits behind each open pull request opened from a **fork** are pushed to the destination as a branch, default `syncerd/pr/<number>`. Without it those commits reach the destination nowhere, since a fork pull request has no branch in the source repository. A pull request opened from a source branch already mirrors under its own name and gets no second copy. The pull request itself is not recreated at the destination yet. Off by default because a fork head is third-party code, and a destination that builds on branch push would run it: read the security note in [docs/git-sync-runbook.md](docs/git-sync-runbook.md#mirroring-pull-request-heads) before enabling it.
 
-**Mirrored pull requests (opt in):** add `pull_requests.mirror_objects: true` and each open source pull request is recreated at the destination as a real pull request, kept in step on every run, with its discussion, inline review comments, and review verdicts. The source is the single authority; nothing written at the destination flows back. A merged source pull request is closed at the destination with a note naming the merge commit, never merged there, because a destination merge would diverge from the mirrored base branch. Review verdicts are mirrored as attributed text rather than real approvals. Mentions and issue references in mirrored text are neutralised so a mirror never notifies or cross links anyone. GitHub on both ends for now.
+**Mirrored pull requests (opt in):** add `pull_requests.mirror_objects: true` and each open source pull request is recreated at the destination as a real pull request, kept in step on every run, with its discussion, inline review comments, and review verdicts. The source is the single authority; nothing written at the destination flows back. A merged source pull request is closed at the destination with a note naming the merge commit, never merged there, because a destination merge would diverge from the mirrored base branch. Review verdicts are mirrored as attributed text rather than real approvals. Mentions and issue references in mirrored text are neutralised so a mirror never notifies or cross links anyone. All five provider types work, in any direction; the runbook has a table of what each one cannot represent (Bitbucket and CodeCommit cannot reopen, neither has labels, CodeCommit has no drafts).
 
 Run with `--dry-run` to print the ref changes each mirror would make, per repository, without creating, pushing, or deleting anything.
 

docs/git-sync-runbook.md

@@ -671,8 +671,55 @@ person at the destination is left alone, even though the source is the
 authority: the source is authority over what it published, not over what
 somebody else said.
 
-Today this needs GitHub on both ends. Any other destination is rejected at
-startup.
+### What survives the crossing
+
+Every provider type can mirror pull requests, in any direction. They do not
+agree on what a pull request has, so some things are approximated and some
+are lost. This table is the whole of it:
+
+| | GitHub | GitLab | Bitbucket | Azure DevOps | CodeCommit |
+|---|---|---|---|---|---|
+| Reopen a closed mirror | yes | yes | **no** | yes | **no** |
+| Draft | yes | via a `Draft:` title prefix | yes | on create only | **no** |
+| Update watermark | yes | yes | yes | **none reported, so every run reconciles** | yes |
+| Labels | yes | yes | **no** | yes | **no** |
+| Inline comment anchors | yes | needs the source to report commit SHAs | yes | yes | yes |
+| Comment deletion | removed | removed | removed | **tombstone** | **content blanked** |
+
+Nothing here fails a run. A capability the destination lacks is logged and
+skipped, never faked:
+
+- **Reopen.** Bitbucket has no reopen endpoint and CodeCommit permits only
+  `OPEN` to `CLOSED`. A destination pull request closed by hand while its
+  source is still open stays closed, and SyncerD warns once and records the
+  divergence rather than opening a second pull request for the same work.
+  Nothing else is attempted on it, because both providers reject an update
+  to a closed pull request. Reopen it by hand and the next run picks it up
+  again: the recorded divergence is re-checked, never trusted.
+- **Draft.** GitLab has no draft field, so a draft is expressed by prefixing
+  the title with `Draft:`, and the prefix is stripped when the source leaves
+  draft. This is the one place SyncerD does not copy a title verbatim.
+  CodeCommit ignores the flag.
+- **Labels.** Ignored on Bitbucket and CodeCommit, which have none.
+- **Inline comments.** GitLab and CodeCommit refuse to anchor a comment
+  without commit SHAs. When the source did not report them, the comment is
+  posted as a discussion comment naming the file and line instead of being
+  dropped.
+- **Deletion.** Azure DevOps and CodeCommit delete softly, so a comment
+  deleted at the source leaves a tombstone or an empty comment rather than
+  disappearing.
+
+CodeCommit is also the expensive one: its API returns pull request ids only,
+so each listing costs one extra call per pull request, and it cannot search
+by branch at all, so SyncerD enumerates once per repository per run and
+matches locally. A lookup that misses among the open pull requests
+enumerates the closed ones too, which is what stops a lost state file from
+producing a duplicate.
+
+Azure DevOps reports no update timestamp on a pull request, so there is
+nothing to watermark against and every pull request is reconciled on every
+run. That is slower than the other four and it is the only way to notice an
+edit there at all.
 
 **Read this before enabling it.** A fork pull request head is code written by
 anyone who can open a pull request against the source. Turning this on pushes

go.mod

@@ -3,9 +3,11 @@ module github.com/clouddrove/syncerd
 go 1.25.0
 
 require (
+	github.com/aws/aws-sdk-go-v2 v1.43.6
 	github.com/aws/aws-sdk-go-v2/config v1.32.36
 	github.com/aws/aws-sdk-go-v2/service/codecommit v1.37.0
 	github.com/aws/aws-sdk-go-v2/service/ecr v1.60.6
+	github.com/aws/smithy-go v1.27.8
 	github.com/google/go-containerregistry v0.19.0
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/spf13/cobra v1.8.0
@@ -14,7 +16,6 @@ require (
 )
 
 require (
-	github.com/aws/aws-sdk-go-v2 v1.43.6 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.35 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.36 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.37 // indirect
@@ -26,7 +27,6 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sso v1.33.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.45.5 // indirect
-	github.com/aws/smithy-go v1.27.8 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
 	github.com/docker/cli v29.6.1+incompatible // indirect
 	github.com/docker/distribution v2.8.2+incompatible // indirect

internal/gitsync/build.go

@@ -144,7 +144,7 @@ func BuildMirrors(cfg *config.GitConfig) ([]Mirror, *Redactor, error) {
 		if mc.PullRequests.Enabled {
 			sourcePRs, ok = src.(vcs.PullRequestLister)
 			if !ok {
-				return nil, nil, fmt.Errorf("mirror %q: pull_requests is enabled but source provider %q (type %q) cannot list pull requests; GitHub is supported today and the remaining provider types arrive in a later release", mc.Name, mc.Source, src.Type())
+				return nil, nil, fmt.Errorf("mirror %q: pull_requests is enabled but source provider %q (type %q) cannot list pull requests", mc.Name, mc.Source, src.Type())
 			}
 		}
 
@@ -157,16 +157,16 @@ func BuildMirrors(cfg *config.GitConfig) ([]Mirror, *Redactor, error) {
 		if mc.PullRequests.MirrorObjects {
 			destPRs, ok = dst.(vcs.PullRequestWriter)
 			if !ok {
-				return nil, nil, fmt.Errorf("mirror %q: pull_requests.mirror_objects is set but destination provider %q (type %q) cannot write pull requests; GitHub is supported today and the remaining provider types arrive in a later release", mc.Name, mc.Destination, dst.Type())
+				return nil, nil, fmt.Errorf("mirror %q: pull_requests.mirror_objects is set but destination provider %q (type %q) cannot write pull requests", mc.Name, mc.Destination, dst.Type())
 			}
 			if mc.PullRequests.CommentsOrDefault() || mc.PullRequests.ReviewsOrDefault() {
 				sourceConv, ok = src.(vcs.PullRequestConversation)
 				if !ok {
-					return nil, nil, fmt.Errorf("mirror %q: pull request comments are enabled but source provider %q (type %q) cannot read them; set comments: false and reviews: false, or wait for that provider", mc.Name, mc.Source, src.Type())
+					return nil, nil, fmt.Errorf("mirror %q: pull request comments are enabled but source provider %q (type %q) cannot read them; set comments: false and reviews: false", mc.Name, mc.Source, src.Type())
 				}
 				destConv, ok = dst.(vcs.PullRequestConversation)
 				if !ok {
-					return nil, nil, fmt.Errorf("mirror %q: pull request comments are enabled but destination provider %q (type %q) cannot write them; set comments: false and reviews: false, or wait for that provider", mc.Name, mc.Destination, dst.Type())
+					return nil, nil, fmt.Errorf("mirror %q: pull request comments are enabled but destination provider %q (type %q) cannot write them; set comments: false and reviews: false", mc.Name, mc.Destination, dst.Type())
 				}
 			}
 		}

internal/gitsync/build_test.go

@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/clouddrove/syncerd/internal/config"
+	"github.com/clouddrove/syncerd/internal/vcs"
 )
 
 func buildableConfig() *config.GitConfig {
@@ -289,15 +290,82 @@ func TestBuildMirrorsWiresPullRequests(t *testing.T) {
 	}
 }
 
-func TestBuildMirrorsRejectsAPullRequestSourceThatCannotList(t *testing.T) {
-	cfg := buildableConfig()
-	cfg.Mirrors[0].Source = "gl"
-	cfg.Mirrors[0].Destination = "gh"
-	cfg.Mirrors[0].PullRequests = config.PullRequestsConfig{Enabled: true}
+// prCapableProviders is every provider type that can mirror pull requests.
+// All five can, since P3; the table exists so a regression in any one of
+// them fails here rather than at run time in somebody's mirror.
+var prCapableProviders = []config.GitProviderConfig{
+	{Name: "p-github", Type: "github", Owner: "acme", Token: "ghp_token_value"},
+	{Name: "p-gitlab", Type: "gitlab", Owner: "acme", Token: "glpat_token_value"},
+	{Name: "p-bitbucket", Type: "bitbucket", Owner: "acme", Email: "svc@acme.com", Token: "bb_token_value"},
+	{Name: "p-azuredevops", Type: "azuredevops", Owner: "acme", Project: "proj", Token: "ado_token_value"},
+	{Name: "p-codecommit", Type: "codecommit", Region: "us-east-1", GitUsername: "u", GitPassword: "p"},
+}
+
+func TestEveryProviderTypeCanMirrorPullRequests(t *testing.T) {
+	for _, src := range prCapableProviders {
+		for _, dst := range prCapableProviders {
+			if src.Name == dst.Name {
+				continue
+			}
+			t.Run(src.Type+"-to-"+dst.Type, func(t *testing.T) {
+				cfg := &config.GitConfig{
+					Providers: prCapableProviders,
+					Mirrors: []config.MirrorConfig{{
+						Name: "m", Source: src.Name, Destination: dst.Name,
+						PullRequests: config.PullRequestsConfig{Enabled: true, MirrorObjects: true},
+					}},
+				}
+				cfg.ApplyDefaults()
+
+				mirrors, _, err := BuildMirrors(cfg)
+				if err != nil {
+					t.Fatalf("build: %v", err)
+				}
+				m := mirrors[0]
+				if m.SourcePRs == nil {
+					t.Error("source lister not wired")
+				}
+				if m.DestPRs == nil {
+					t.Error("destination writer not wired")
+				}
+				if m.SourceConv == nil || m.DestConv == nil {
+					t.Error("conversation endpoints not wired")
+				}
+			})
+		}
+	}
+}
 
-	_, _, err := BuildMirrors(cfg)
-	if err == nil || !strings.Contains(err.Error(), "pull_requests") {
-		t.Fatalf("expected an error naming pull_requests, got %v", err)
+func TestOnlySomeDestinationsCanReopen(t *testing.T) {
+	// Bitbucket has no reopen endpoint and CodeCommit forbids the
+	// transition, so the engine must see the capability absent on exactly
+	// those two and present on the rest.
+	want := map[string]bool{
+		"github": true, "gitlab": true, "azuredevops": true,
+		"bitbucket": false, "codecommit": false,
+	}
+
+	for _, dst := range prCapableProviders {
+		cfg := &config.GitConfig{
+			Providers: prCapableProviders,
+			Mirrors: []config.MirrorConfig{{
+				Name: "m", Source: "p-github", Destination: dst.Name,
+				PullRequests: config.PullRequestsConfig{Enabled: true, MirrorObjects: true},
+			}},
+		}
+		if dst.Name == "p-github" {
+			cfg.Mirrors[0].Source = "p-gitlab"
+		}
+		cfg.ApplyDefaults()
+
+		mirrors, _, err := BuildMirrors(cfg)
+		if err != nil {
+			t.Fatalf("%s: build: %v", dst.Type, err)
+		}
+		_, canReopen := mirrors[0].DestPRs.(vcs.PullRequestReopener)
+		if canReopen != want[dst.Type] {
+			t.Errorf("%s reopen capability = %v, want %v", dst.Type, canReopen, want[dst.Type])
+		}
 	}
 }
 
@@ -316,7 +384,6 @@ func TestBuildMirrorsLeavesPullRequestsOffByDefault(t *testing.T) {
 
 func TestBuildMirrorsWiresPullRequestObjects(t *testing.T) {
 	cfg := buildableConfig()
-	// GitHub on both ends: the only pair that can write pull requests today.
 	cfg.Mirrors[0].Destination = "gh2"
 	cfg.Providers = append(cfg.Providers, config.GitProviderConfig{
 		Name: "gh2", Type: "github", Owner: "mirror", Token: "ghp_token_value_two",
@@ -341,13 +408,3 @@ func TestBuildMirrorsWiresPullRequestObjects(t *testing.T) {
 		t.Errorf("switches = %+v", m.PullRequests)
 	}
 }
-
-func TestBuildMirrorsRejectsADestinationThatCannotWritePullRequests(t *testing.T) {
-	cfg := buildableConfig()
-	cfg.Mirrors[0].PullRequests = config.PullRequestsConfig{Enabled: true, MirrorObjects: true}
-
-	_, _, err := BuildMirrors(cfg)
-	if err == nil || !strings.Contains(err.Error(), "mirror_objects") {
-		t.Fatalf("a GitLab destination cannot write pull requests yet, want that error, got %v", err)
-	}
-}

internal/prsync/comments.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/clouddrove/syncerd/internal/logging"
 	"github.com/clouddrove/syncerd/internal/state"
@@ -79,11 +80,23 @@ func syncConversation(ctx context.Context, pr vcs.PullRequest, destNumber int, o
 	}
 
 	// A source comment that has since been deleted takes its mirrored copy
-	// with it, but only the copy SyncerD wrote.
+	// with it, but only the copy SyncerD wrote, and only in a category this
+	// run actually listed.
+	//
+	// That second condition matters: without it, turning comments off would
+	// delete every comment previously mirrored, and turning reviews off
+	// would delete every mirrored verdict, because nothing in those
+	// categories would appear in seen.
 	for sourceID, destID := range rec.CommentIDs {
 		if seen[sourceID] {
 			continue
 		}
+		if isReviewKey(sourceID) && !opts.Reviews {
+			continue
+		}
+		if !isReviewKey(sourceID) && !opts.Comments {
+			continue
+		}
 		if opts.DryRun {
 			logging.Info(fmt.Sprintf("mirror %s: would delete mirrored comment %s on destination pull request %d", opts.Mirror, destID, destNumber))
 			continue
@@ -98,6 +111,12 @@ func syncConversation(ctx context.Context, pr vcs.PullRequest, destNumber int, o
 	return created, downgraded, nil
 }
 
+// isReviewKey reports whether a tracked id belongs to a mirrored review
+// verdict rather than a comment. ComposeReview prefixes those keys.
+func isReviewKey(sourceID string) bool {
+	return strings.HasPrefix(sourceID, "review-")
+}
+
 // upsert posts a comment the first time and rewrites it after that.
 func upsert(ctx context.Context, opts Options, destNumber int, rec *state.PRRecord, sourceID, body string) (int, error) {
 	if destID, ok := rec.CommentIDs[sourceID]; ok {