From 33f0bcfb478930d2baff03b01c14ae44d208b166 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 9 Jun 2026 23:48:58 +0000
Subject: [PATCH 1/3] Initial plan


From b72ebcda1eefe9dbe4f619810ee53a7f6cab9117 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 9 Jun 2026 23:50:29 +0000
Subject: [PATCH 2/3] Add .config/tsaoptions.json and wire TSA config in
 release pipeline

---
 .config/tsaoptions.json               | 11 +++++++++++
 pipelines/azure-pipelines.release.yml |  6 ++++++
 2 files changed, 17 insertions(+)
 create mode 100644 .config/tsaoptions.json

diff --git a/.config/tsaoptions.json b/.config/tsaoptions.json
new file mode 100644
index 00000000..815125de
--- /dev/null
+++ b/.config/tsaoptions.json
@@ -0,0 +1,11 @@
+{
+    "instanceUrl": "https://microsoft.visualstudio.com",
+    "projectName": "OS",
+    "areaPath": "OS\\Windows Client and Services\\WinPD\\DFX-Developer Fundamentals and Experiences\\DEFT\\InstaDev",
+    "iterationPath": "OS\\Future",
+    "notificationAliases": [
+        "instadev@microsoft.com"
+    ],
+    "ignoreBranchName": true,
+    "repositoryName": "winget-create"
+}
diff --git a/pipelines/azure-pipelines.release.yml b/pipelines/azure-pipelines.release.yml
index e3d5012c..7aaa93c6 100644
--- a/pipelines/azure-pipelines.release.yml
+++ b/pipelines/azure-pipelines.release.yml
@@ -32,6 +32,12 @@ resources:
 extends:
   template: v2/Microsoft.Official.yml@templates
   parameters:
+    globalSdl:
+      tsa:
+        enabled: true
+        configFile: $(Build.SourcesDirectory)\.config\tsaoptions.json
+        onboard: false
+
     featureFlags:
       WindowsHostVersion:
         Version: 2022

From 97b4aa44d5cc0ced71235f6a9502e54ba8823a53 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 10 Jun 2026 05:56:29 +0000
Subject: [PATCH 3/3] Add tsa and tsaoptions to spelling allowlist

---
 .github/actions/spelling/allow.txt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index c98d3d75..ad50d6cf 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -117,5 +117,7 @@ xffff
 yml
 zhuangtongfa
 DWM
+tsa
+tsaoptions
 tzautoupdate
 Usb