Allow configuring certificate revocation checks for GitHub App marketplace plugin installation

git clone を呼び出すマーケットプレイスプラグインのインストールフローから始め、issue に記載された Windows Schannel エラーを再現します。マーケットプレイスからのダウンロード中にローカルの Git 証明書設定が使用されるかを確認し、その後、アプリケーション設定またはエンタープライズポリシーで失効動作を制御する方法を判断します。安全なデフォルトを変更せず、影響を受けるインストールが設定された動作で続行できれば完了です。

Feature summary

Provide an option to control certificate revocation checking when GitHub App installs plugins from GitHub Marketplace repositories. This would help enterprise environments where TLS inspection or corporate certificate authorities prevent successful revocation verification.

What problem are you trying to solve?

Failed to install plugin
Failed to fetch marketplace: Failed to fetch GitHub marketplace github/copilot-plugins: Command failed: git clone --depth 1 --progress https://github.com/github/copilot-plugins.git C:\Users\test\AppData\Local\copilot\marketplaces\github-copilot-plugins
Cloning into 'C:\Users\test\AppData\Local\copilot\marketplaces\github-copilot-plugins'...
fatal: unable to access 'https://github.com/github/copilot-plugins.git/': schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012)

Proposed solution

Add one of the following options: 1. Respect local Git certificate settings (for example http.schannelCheckRevoke) 2. Allow configuration of revocation checking behavior in the application settings 3. Provide an enterprise policy to control certificate validation during marketplace plugin downloads Default behavior can remain secure, while allowing administrators to support environments with non-standard PKI infrastructure.

Workflow impact

The repository itself is reachable and GitHub services are available.

The failure occurs because Windows Schannel cannot complete certificate revocation validation for certificates issued by corporate security solutions (for example TLS inspection proxies, Global Secure Access, enterprise PKI, etc.).

Currently there appears to be no way to:

Disable revocation checking for marketplace downloads
Configure an alternative certificate validation mode
Use existing Git settings related to Schannel revocation behavior

As a result, plugin installation is blocked in affected enterprise environments even though network connectivity and certificate trust are otherwise valid.

Installation context

Additional context

The issue occurs only when certificates issued by Microsoft Global Secure Access are present.

GitHub Marketplace access is available and network connectivity works correctly.

The failure is caused by Windows Schannel revocation validation returning:

CRYPT_E_NO_REVOCATION_CHECK (0x80092012)

Other Git operations can be made to work by disabling revocation checks through Git configuration, but GitHub App marketplace installation currently does not provide a similar option.