lodash/lodash
There is no server or CLI entrypoint; the shipped artifact is `lodash.js`, declared as `main` in a `private: true` package.json, exported via a three-way UMD tail (AMD `define`, CommonJS `freeModule.exports`, global `root._`). All build logic lives in `lib/`, split into `lib/common/` (file copy, uglify wrapper, error-throwing callback, Hash), `lib/main/` (dist, modules, docdown, site HTML) and `lib/fp/` (webpack dist, `.jst`-templated module emission, FP wiki). The only persistent storage is the filesystem: `dist/` for builds and `doc/README.md` for generated API docs. Eight GitHub Actions workflows cover Node 4–25, four Bun versions, browser matrix, docs generation, dist-sync verification, CodeQL, OSSF Scorecard and Renovate. Deployment is out-of-repo — the Release Team publishes to npm, and `dist/lodash.core.js` is produced by the external `lodash-cli`, not by `npm run build`.
- The package is `private: true` with `main: "lodash.js"` and `engines.node >= 4.0.0`, so the repo itself is never published; it is the source-of-truth checkout that other release tooling consumes.
- `lodash.js` is a single `;(function() { ... }.call(this))` IIFE whose entire API is built inside a `runInContext(context)` factory at line 1449; the module-level `var _ = runInContext()` at line 17232 creates the default instance.
- The export tail branches three ways in strict order — AMD `define.amd` (also assigning `root._` to survive script-tag loading), then `freeModule.exports` for Node/CommonJS, then a bare global assignment — which is why the file works unchanged in every listed CI runtime.
- Runtime-boundary detection is done once at the top level via `freeGlobal`/`freeSelf`/`Function('return this')()` for `root`, plus `freeExports`, `freeModule`, `moduleExports` and `freeProcess` for Node-only features like `Buffer` and `util.types`.
- `npm run build` is only `build:main && build:fp`: `lib/main/build-dist.js` copies `lodash.js` → `dist/lodash.js` and minifies it, while `lib/fp/build-dist.js` runs two webpack passes (`fp/_mapping.js` → `dist/mapping.fp.js`, `fp/_convertBrowser.js` → `dist/lodash.fp.js`, both UMD) then minifies.
- Minification is centralized in `lib/common/minify.js`, which shells into `uglify-js@2.7.5` with `unsafe: true`, `pure_getters: true`, `ascii_only: true` and a `/@license/` comment filter from `lib/common/uglify.options.js`.
- All build scripts share the same async shape: `lib/common/file.js` returns `_.partial`-applied `fs.copy`/`minify`/`fs.writeFile` thunks that are handed to `async.series` with `util.pitch` as the terminal callback, and `pitch` simply rethrows any error.
- `lib/common/mapping.js` wraps `fp/_mapping.js` in a null-prototype `Hash` (recursively, via `_.transform` with `Hash.prototype = Object.create(null)`), so build-time lookups like `mapping.skipFixed[name]` can't collide with inherited `Object.prototype` keys.
- Documentation is a two-stage pipeline: `lib/main/build-doc.js` runs `docdown` over `lodash.js` in either `github` or `site` style and writes `doc/README.md`; `lib/main/build-site.js` then feeds that markdown through `marky-markdown` + `cheerio` and emits `doc/<version>.html` with Jekyll front matter.
- `doc/README.md` is a checked-in 295 KB generated artifact (its first line carries the `v4.18.1` docdown title), and `doc/*.html` is gitignored — so the markdown is versioned but the site HTML is not.
- Eight workflows exist: `ci-node.yml` (Node 4 through 25 on ubuntu, `npm run validate`), `ci-bun.yml` (Bun 1.0–1.3), `browser-testing.yml` (Playwright), `ci-docs.yml`, `ci-dist-sync.yml`, `codeql.yml`, `scorecards.yml`, `renovate.yml`.
- Every third-party action is SHA-pinned (e.g. `actions/checkout@3d3c42e5...` v7.0.1, `github/codeql-action/init@b96794f0...` v4.38.0), and Renovate is self-hosted monthly with `minimumReleaseAge: 14d` and npm major updates disabled.
- `vendor/` carries four vendored third-party trees used only by the browser harnesses — Backbone (source + 7 test files + setup), Underscore (source, min, 7 test files), json-js `json2.js`, and a ~960 KB `firebug-lite` console used by the perf page.
- Deployment is explicitly out-of-repo: `GOVERNANCE.md` names a single-member Release Team responsible for npm publishes, and the README documents that `dist/` builds come from `lodash-cli` (`lodash -o ./dist/lodash.js`).