The hardware and bandwidth for this mirror is donated by METANET, the Webhosting and Full Service-Cloud Provider.
If you wish to report a bug, or if you are interested in having us mirror your free-software or open-source project, please feel free to contact us at mirror[@]metanet.ch.
risk.assessr helps in the initial determining of a package’s reliability and security in terms of maintenance, documentation, and dependencies.
This package is designed to carry out a risk assessment of R packages at the beginning of the validation process (either internal or open source).
It calculates risk metrics such as:
Core metrics - includes R command check, unit test coverage and composite coverage of dependencies
Documentation metrics - availability of vignettes, news tracking, example(s), return object description for exported functions, and type of license
Dependency Metrics - package dependencies and reverse dependencies
It also calculates a:
Traceability matrix - matching the function / test descriptions to tests and match to test pass/fail
This package executes the following tasks:
upload the source package(tar.gz file)
Unpack the tar.gz file
Install the package locally
Run code coverage
Run a traceability matrix
Run R CMD check
Run risk assessment metrics using default or user defined weighting
This package fixes a number of errors in
pharmaR/riskmetric
Suggests added to checking dependenciesassess_dependencies and
assess_reverse_dependencies has sigmoid point
increasedassess_dependencies has value range changed to fit in
with other scoring metricsCreate a Personal Access Token (PAT) on
github
github accountCreate a .Renviron file with your GITHUBTOKEN
as:
# .Renviron
GITHUBTOKEN=dfdxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxfdfauth_token = Sys.getenv("GITHUBTOKEN")
devtools::install_github("Sanofi-Public/risk.assessr", ref = "main", auth_token = auth_token)options(repos = "http://cran.us.r-project.org")
installed.packages(risk.asssessr)To assess your package, do the following steps:
1 - save your package as a tar.gz file
RStudio ->
Build Tab -> More ->
Build Source Package2 - Run the following code sample by loading or add path parameter to
your tar.gz package source code
Set repository options
options(repos = c(
RSPM = "http://cran.us.r-project.org",
INTERNAL_RSPM = "<your_internal_RSPM>"
))This sets up repository sources for R packages allows you to access both public (CRAN/Bioconductor) and internal packages
When you install or load packages, R will:
First check the RSPM repository for CRAN/Bioconductor packages Then look in the INTERNAL repository for internal-specific packages Finally, search INTERNAL_RSPM if packages aren’t found in the previous locations
# for local tar.gz R package
risk_assess_package <- risk_assess_pkg()
risk_assess_package <- risk_assess_pkg(path/to/your/package)This function processes renv.lock to produce risk metric
data for each package.
# for local renv.lock file
risk_assess_package <- risk_assess_pkg_lock_files(path/to/your/lockfile)Note: This process can be very time-consuming and is recommended to be performed as a batch job or within a GitHub Action.
To check a source code package from CRAN or
bioconductor, run the following code:
risk_assess_package <- assess_pkg_r_package(package_name, package_version)| Key Metrics | Reason | where to find them in Metrics and Risk assessment |
|---|---|---|
| RCMD check | series of 45 package checks of tests, package structure, documentation | check element in results list,
check_list |
| test coverage | unit test coverage | covr element in results list,
covr_list |
| risk analysis | rules and thresholds to identify risks | risk_analysis |
| traceability matrix | maps exported functions to test coverage, documentation by risk and function type | tm_list |
results
├── pkg_name: "admiral"
├── pkg_version: "1.0.2"
├── pkg_source_path
├── date_time
├── executor
├── sysname, version, release, machine, comments
├── license: 1
├── license_name: "Apache License (>= 2)"
├── size_codebase: 0.9777
├── has_bug_reports_url, has_examples, has_maintainer, has_news
├── has_source_control, has_vignettes, has_website, news_current
├── export_help: 0
├── check: 0
├── covr: 0
├── dependencies
│ ├── imports: [list of packages with versions]
│ └── suggests: [list of packages with versions]
├── suggested_deps: [list of 5 dependency issues]
├── author
│ ├── maintainer: [Ben Straub info]
│ ├── funder: [list of organizations]
│ └── authors: [list of contributors]
├── host
│ ├── github_links
│ ├── cran_links
│ ├── internal_links
│ └── bioconductor_links
├── github_data
│ ├── created_at
│ ├── stars, forks
│ ├── date
│ ├── recent_commits_count
│ └── open_issues
├── download
│ ├── total_download
│ └── last_month_download
├── rev_deps: [list of reverse dependencies]
├── version_info
│ ├── all_versions: [list of version/date pairs]
│ ├── last_version
│ └── difference_version_months
├── tests
│ ├── has_testthat
│ ├── has_snaps
│ ├── has_testit
│ ├── n_golden_tests
│ └── n_test_files
└── risk_profile: "High"covr_list
├── total_cov: "NA"
└── res_cov
├── name: "admiral"
├── coverage
│ ├── filecoverage: null
│ └── totalcoverage: "NA"
└── errors: [callr traceback]check_list
├── res_check
│ ├── stdout, stderr, status, duration
│ ├── errors, warnings, notes
│ ├── checkdir
│ └── description (DESCRIPTION file content)
└── check_score: 0risk_analysis
├── dependencies_count: "low"
├── later_version: "high"
├── code_coverage: "high"
├── last_month_download: "high"
├── license: "low"
├── reverse_dependencies_count: "medium"
├── documentation_score: "high"
└── cmd_check: "high"tm_list
├── pkg_name: "admiral"
└── coverage
├── filecoverage: 0
└── totalcoverage: 0suggested_deps
├── [1]
│ ├── source: "create_period_dataset"
│ ├── suggested_function: "matches"
│ ├── targeted_package: "testthat"
│ └── message: "Please check if the targeted package should be in Imports"
├── [2]
│ ├── source: "create_single_dose_dataset"
│ ├── suggested_function: "it"
│ ├── targeted_package: "testthat"
│ └── message: "Please check if the targeted package should be in Imports"
├── [3]
│ ├── source: "derive_vars_merged"
│ ├── suggested_function: "it"
│ ├── targeted_package: "testthat"
│ └── message: "Please check if the targeted package should be in Imports"
├── [4]
│ ├── source: "list_tte_source_objects"
│ ├── suggested_function: "br"
│ ├── targeted_package: "htmltools"
│ └── message: "Please check if the targeted package should be in Imports"
├── [5]
│ ├── source: "use_ad_template"
│ ├── suggested_function: "it"
│ ├── targeted_package: "testthat"
│ └── message: "Please check if the targeted package should be in Imports"Gillian E, Bottois H, Charliquart P, Couturier A (2025). risk.assessr: Assessing Package Risk Metrics. R package version 2.0.0, https://probable-chainsaw-kgro2o7.pages.github.io/.
@Manual{,
title = {risk.assessr: Assessing Package Risk Metrics},
author = {Edward Gillian and Hugo Bottois and Paulin Charliquart and Andre Couturier},
year = {2025},
note = {R package version 2.0.0},
url = {https://probable-chainsaw-kgro2o7.pages.github.io/},
}The project is inspired by the riskmetric
package and the mpn.scorecard
package and draws on some of their ideas and functions.
These binaries (installable software) and packages are in development.
They may not be fully stable and should be used with caution. We make no claims about them.