Allow configuring certificate revocation checks for GitHub App marketplace plugin installation

Feature summary

Provide an option to control certificate revocation checking when GitHub App installs plugins from GitHub Marketplace repositories. This would help enterprise environments where TLS inspection or corporate certificate authorities prevent successful revocation verification.

What problem are you trying to solve?

Failed to install plugin
Failed to fetch marketplace: Failed to fetch GitHub marketplace github/copilot-plugins: Command failed: git clone --depth 1 --progress https://github.com/github/copilot-plugins.git C:\Users\test\AppData\Local\copilot\marketplaces\github-copilot-plugins
Cloning into 'C:\Users\test\AppData\Local\copilot\marketplaces\github-copilot-plugins'...
fatal: unable to access 'https://github.com/github/copilot-plugins.git/': schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012)

Proposed solution

Add one of the following options: 1. Respect local Git certificate settings (for example http.schannelCheckRevoke) 2. Allow configuration of revocation checking behavior in the application settings 3. Provide an enterprise policy to control certificate validation during marketplace plugin downloads Default behavior can remain secure, while allowing administrators to support environments with non-standard PKI infrastructure.

Workflow impact

The repository itself is reachable and GitHub services are available.

The failure occurs because Windows Schannel cannot complete certificate revocation validation for certificates issued by corporate security solutions (for example TLS inspection proxies, Global Secure Access, enterprise PKI, etc.).

Currently there appears to be no way to:

Disable revocation checking for marketplace downloads
Configure an alternative certificate validation mode
Use existing Git settings related to Schannel revocation behavior

As a result, plugin installation is blocked in affected enterprise environments even though network connectivity and certificate trust are otherwise valid.

Installation context

Additional context

The issue occurs only when certificates issued by Microsoft Global Secure Access are present.

GitHub Marketplace access is available and network connectivity works correctly.

The failure is caused by Windows Schannel revocation validation returning:

CRYPT_E_NO_REVOCATION_CHECK (0x80092012)

Other Git operations can be made to work by disabling revocation checks through Git configuration, but GitHub App marketplace installation currently does not provide a similar option.

Start at the marketplace plugin installation flow that invokes git clone, and reproduce the Windows Schannel error described in the issue. Review whether local Git certificate settings are used during marketplace downloads, then determine how an application setting or enterprise policy could control revocation behavior. Done means affected installations can proceed with the configured behavior while the secure default remains unchanged.