Supporting a wider range of external plugins

[aaronpowell]

TL;DR

We now support external plugins sourced from repos not owned by GitHub/Microsoft.

Expanding the process

Since we started supporting external plugins in the repo we have had many organisations reach out to us about having their plugin listed in the marketplace, but as was outlined in #1172, this was not possible without being a select partner. The problem was that was a very ambiguous process which lacked transparency and simplicity. This, combined with the inherent risk that a marketplace with external plugins pose (I won't rehash all the details in #1172 about how plugin marketplaces work within Copilot) left quite a few organisations stuck in an ill-defined process with no real end in sight.

Well, after working with various stakeholders around GitHub over the past several weeks, I'm happy to announce that we are making the first steps forward in implementing a new process that will support our partners.

How the process works

Something that we wanted in place was transparency on how the process would work to support submissions - not "send an email to and hope it gets a tick of approval", but something where the submitter and people wanting to consume what they submit can see the process in action.

To achieve this, we are using GitHub Issues in this repo to manage the process. The overall view of the workflow is:

• An issue will be opened using this issue template.
  • This is important as it uses a form to capture all the relevant details that we need for the plugin definition.
• The submission is reviewed for validation (automated via GitHub Actions) and maintainer review (human review).
  • The maintainer review will act similar to a PR review of a submission to the repo, but against the external source, looking for usefulness, completeness, etc. so our users will have the same confidence level as with items submitted to the repo directly.
• If approved, a PR will automatically be generated, which will then be reviewed (to make sure it was generated correctly - hey, computers get it wrong sometimes!) before being merged in
• After 6 months, the submission will be flagged for re-review. This is to ensure that it is kept up to date and useful, just the same as we do with items directly in the repo via the staleness report.

Submitted plugins will point to a SHA or other immutable ref on the remote GitHub repo. This will reduce the potential for hijacking once it's in the repo, and if there are changes to the upstream, we'll expect a version bump to the external plugin to be submitted as a PR.

Can individuals submit

We talk about "partners" a lot in how we describe external plugins, but let's say you're an individual who has a plugin that they believe is of benefit to the community, can you submit it?

Yes - this is another reason why we didn't use any existing partner program that there is at GitHub/Microsoft, they tend to be tied to an organisation, but we want to support those individuals in the community who are also making Copilot the best agentic tool out there.

You'll follow the same process as above, and we may be a bit stricter on the review front as the rise in purely AI-driven submissions can result in lower-quality submissions - so don't take it personally, we just want to ensure that we aren't degrading peoples experience with Copilot.

Thanks everyone for their patience on this - I expect we'll have some teething issues as we start rolling this out, but trust me, we've got our best engineer on the job !