# Source and release profile Marionette keeps its contributor and release toolchain reproducible without narrowing the runtime contract for package consumers. The machine-readable authority is [`config/release-profile.json`](https://github.com/marionettejs/marionette/blob/13f4954c352e646c413091ffdd83f6da59404573/config/release-profile.json). The current source profile uses Node 24.19.0 and npm 11.17.0. `.nvmrc`, the `packageManager` declaration, CI, and `npm run check:release-profile` must agree with that file. The public package continues to support the Node range declared in `engines`; the exact source profile identifies the environment used to build and verify a release. ## Contributor setup With `nvm` installed: ```sh nvm install nvm use npm run check:release-profile npm ci npm run check:browser-profile ``` The Node release pinned here includes the pinned npm version. If another version of npm is earlier on your path, select npm 11.17.0 before installing dependencies. npm 11.17 records reviewed dependency installers in each package's top-level `allowScripts` map. The repository enables `strict-allow-scripts` in `.npmrc`, so installing a package whose scripts have not been reviewed fails instead of silently executing them. Use `npm approve-scripts --allow-scripts-pending` to inspect pending packages, review the exact package and version, and then use `npm approve-scripts ` to add a version-pinned approval. Isolated fixture packages keep their own approvals. PR CI runs the complete suite on the canonical Ubuntu 24.04 x64 host and clean installation and packed-package fixtures on macOS 15 arm64. The full Windows 2025 x64 package-fixture suite runs after merge on pushes to `master`, and remains a required gate for release artifacts. Windows failures therefore surface after merge without delaying routine PRs. Release dry runs on PRs test macOS; manually dispatched release validation tests both macOS and Windows against the exact candidate tarballs before publication. GitHub's fixed OS labels still receive runner-image updates, so release evidence records the actual image reported by each run. Hosted-runner timings remain informative rather than hard performance gates. ## Browser profiles Browser behavior and transpilation use separate pinned profiles. The real-browser contract lane uses `@playwright/test` 1.63.0 with Chromium 153.0.8010.12 revision 1243, Firefox 155.0 revision 1543, and WebKit 26.6 revision 2359. These are the builds published for the [Playwright 1.63 release](https://playwright.dev/docs/release-notes#version-163). Playwright WebKit is the compatibility engine; it is not evidence that branded Safari ran in CI. `npm run test:browser` runs named Playwright projects for all three engines. CI installs their pinned binaries and retains results, reports, and failure traces. Release validation supplies the exact candidate tarballs to this same suite. A local `npm ci` installs the dependency but does not download browser binaries; install them with Playwright before running browser checks locally. `npm run check:browser-profile` compares the installed Playwright manifest with `config/release-profile.json`. The package and release profile use the semantic Browserslist query `baseline widely available`. This is the minimum capability floor for transpilation, not a fixed list of supported browser versions or an upper limit on newer releases. The browser-profile check requires that exact query and verifies that it resolves successfully. The checked-in lockfile fixes the Browserslist data used by each commit, so clean installs reproduce that commit's resolved targets and build artifacts. Reviewed lockfile updates may advance the resolved target list without changing the public support contract. Resolved versions are build evidence, not manually maintained browser-support ceilings. ## Advancing the profile Profile changes use a dedicated pull request that updates every pin together and passes the PR checks before merge. Post-merge Windows validation and complete release-artifact validation must pass before the new profile is released. - Review Node and npm patches monthly. Allow a seven-day upstream soak unless a security fix requires immediate adoption. - Exercise a new Node major as a nonblocking lane while it is Current. Make it blocking only after it becomes LTS and completes a 30-day project soak. Raising Marionette's minimum supported Node major is a separate major-release decision. - Introduce a replacement host image in parallel before making it canonical. Never use a moving `*-latest` label for release evidence. - Review Playwright browser builds and Browserslist data monthly. Update the dependency, lockfile, and browser-build manifest in one reviewed pull request; changing the semantic transpilation query is a separate support-policy decision, and browser tests remain a separate contract lane. - Freeze the profile for a release candidate. An emergency profile change reruns all release evidence. Documentation publication is defined separately and must not silently change the source, host, or browser pins. Package publication uses the separate [immutable release-promotion contract](/docs/maintainers/release-promotion.md). That workflow records this profile's Git blob revision and SHA-512 in the verified artifact. Changing the profile after a candidate is built requires rebuilding and rerunning the complete release evidence; publication jobs reject an artifact whose recorded profile differs from the checked-out source commit. [Canonical source](/docs/markdown/docs/release-profile.md) · [Source identity](/docs/manifest.json)