CodeVetter · Repo Unpack · Testing signals
lodash/lodash
Testing is QUnit 2 (`qunitjs` + `qunit-extras`) driven two ways: directly under Node via `node test/test` and `node test/test-fp`, and in browsers via Playwright asserting `0 failed` on four static pages. Coverage of the main library is very broad — 307 QUnit modules and ~1754 assertions in `test/test.js` alone, plus 85/134 for FP — and is supplemented by running the vendored Backbone and Underscore suites against lodash. Style is enforced by JSCS across `lodash.js`, `fp/`, `lib/`, `perf/` and `test/`, and docs are tested by executing every README code fence via `markdown-doctest`. The notable gaps are the `lib/` build scripts themselves and the Playwright runner's coarse assertion.
- `test/test.js` contains 307 `QUnit.module(` and 1754 `QUnit.test(` calls in a single 814 KB file; `test/test-fp.js` adds 85 modules and 134 tests.
- `npm run validate` is the CI gate everywhere — it chains `npm run style` (four JSCS invocations) and `npm test` — and is what both `ci-node.yml` and `ci-bun.yml` run.
- The Node matrix is exhaustive and non-fail-fast: Node 4 through 25 on ubuntu-latest, with a special step installing `npm@3.10.10` for Node 5 because of npm 3 package-format bugs.
- Bun CI needs a workaround before it can install: it runs `npm i --lockfile-version 3 --package-lock-only` first because the committed `package-lock.json` is an older lockfile version, flagged with a TODO.
- Browser coverage runs six Playwright projects (Chromium, Firefox, WebKit, Microsoft Edge via msedge channel, Mobile Safari/iPhone 12, Mobile Chrome/Pixel 5) with `retries: 2` under CI and a 120s per-test timeout chosen to exceed the 60s in-page wait.
- Each Playwright spec asserts only that the literal text `0 failed` becomes visible — it does not read which tests ran, so a page that silently fails to load its suite and renders nothing will time out rather than report a specific failure.
- Cross-library regression coverage: `test/backbone.html` runs Backbone's own 7 test files against lodash after `mixin`-ing 17 lodash methods and aliasing `indexBy`→`keyBy`, `invoke`→`invokeMap`, `rest`→`tail`.
- `test/underscore.html` runs Underscore's 7 suites against lodash and carries a large `QUnit.config.excused` map enumerating known, accepted behavioral divergences (e.g. `chunk` size 0, `difference` OO-style, `drop` alias).
- The suite tests lodash against a deliberately hostile environment: `addBizarroMethods` removes `Object.create`/`Symbol`/`getOwnPropertySymbols`, stubs `Promise`/`Set`/`WeakMap` with `noop`, makes `Map` return a plain object on first construction, and fakes `WinRTError` plus `global`/`exports`/`module`.
- There is an explicit minification guard test asserting no exported method name is ≤2 characters except `_`, `at`, `eq`, `gt`, `lt` — catching accidentally shipped minified production builds.
- Documentation is executable: `npm run test:doc` runs `markdown-doctest doc/*.md` with a setup file that deletes `global['__core-js_shared__']` and injects the real `_` plus `lodash-doc-globals` into every example's scope.
- JSCS enforces ~40 rules including `requireEarlyReturn`, `disallowKeywords: ["with"]`, `validateQuoteMarks: '`, 2-space indentation and JSDoc type/param/return checks, but with `maxErrors: 2000` so a large backlog can exist without failing.
- Nothing under `lib/` is unit-tested — `style:fp` lints `lib/**/*.js` but no test file requires `lib/common/file.js`, `lib/common/minify.js` or any `build-*.js`; their only verification is that CI's build step doesn't throw. (inferred)
- Coverage tooling is declared (`istanbul`, `coveralls`, `codecov.io` devDependencies and a PhantomJS `__coverage__` collection path in `test.js`) but no npm script or workflow invokes it, so coverage is effectively dead infrastructure. (inferred)
- CodeQL runs JavaScript analysis on every push/PR to `main` plus weekly on Mondays at 00:00, and OSSF Scorecard runs Tuesdays at 07:20 publishing SARIF to code scanning.