Plugin marketplaces auto-sync: one repo, every seat

Two vendors shipped the same idea within a few days of each other, and the combination is a supply chain change most teams have not priced in. GitHub added autoUpdate for Copilot plugin marketplaces on August 26. OpenAI added marketplace import with automatic daily sync from GitHub repositories to ChatGPT Enterprise, Edu, and Business in late August. In both cases, a Git repository is now the distribution channel for what your team's AI assistant is allowed to do — and it refreshes itself without anyone pressing anything.

What actually happened

On the GitHub side, the changelog entry is short: enterprise-managed settings now accept autoUpdate: true on extraKnownMarketplaces entries. Supported clients then check the marketplace and update installed plugins sourced from it on their own. It is generally available for Copilot Business and Copilot Enterprise across the GitHub Copilot app, Copilot CLI, and VS Code. Note that middle one — the CLI, which runs on developer machines with developer credentials.

On the OpenAI side, the ChatGPT Enterprise and Edu release notes describe workspace admins importing a plugin marketplace from a public or private GitHub repository under Workspace settings → Plugins → Add → Import marketplace, with automatic daily sync and a Sync now button for impatience. Admins keep control of installation policies for eligible roles and required app access; repository policy values do not override workspace settings, and app permissions and authentication still apply.

Both vendors did the governance homework on the installation question. Neither of them can do it on the content question, because that is your repository.

Why plugin auto-sync matters for your business

Here is the honest version of what you just enabled. The set of things every employee's AI assistant can do is now a mutable file in a Git repo, on a daily cron, with no deploy step and no human in the approval path. Whoever can merge to that repo can change tomorrow's capability surface for the whole company. That is not a criticism of the feature — centralized distribution is genuinely better than fifty people installing plugins by hand. It is a description of where the control now lives, so you can go put a gate there.

The realistic failure is not a dramatic supply chain attack. It is that the marketplace repo gets created by whoever set this up, gets no branch protection because it is "just config," accumulates three contributors and a bot, and eighteen months later nobody can say who added the plugin with write access to the billing system. Config repos rot faster than code repos because they never break a build.

Four controls, and they are the same ones you would put on production — because this is production now:

Branch protection and required review on the marketplace repo. Two-person rule on merges. If plugin definitions ship to every seat automatically, the merge is the deploy.

A named owner, in the README, not in someone's head. Plus a rule that plugin additions need a stated business reason and a listed permission scope.

Pin what you can and audit what you can't. Auto-sync is a convenience with a cost: you have traded review for freshness. Know which of your marketplaces are set to autoUpdate: true and be deliberate about it rather than defaulted into it.

Read the permissions, every time. A plugin's blast radius is whatever it can authenticate to. The workspace policy controls who installs; it does not control what the plugin reaches once installed.

We build vendor-agnostic systems for exactly this reason — when the capability layer is a repo you own, you can put a gate on it. Just make sure you actually did.

Sources: GitHub Changelog, OpenAI ChatGPT Enterprise & Edu release notes.