# Using Risk Assessment Functions

## Introduction

This vignette demonstrates how to use the `risk_assess_pkg()` and `assess_pkg_r_package()` functions from the `risk.assessr` package to assess the risk of R packages.

You can assess:

- A local `.tar.gz` source package (by upload and using path)
- A package from CRAN or Bioconductor
- A package defined by an `renv.lock` file

## 1. Assessing a Local Source Package

To assess your own package:

### Step 1: Build your package

Use RStudio: `Build > More > Build Source Package` to generate a `.tar.gz` file.

### Step 2: Upload the package (optional)

If using a web interface or app built on top of the risk engine, upload the `.tar.gz` file through the UI.

### Step 3: Run the assessment

    # Assess a local .tar.gz R package by tar file upload

    # risk_result <- risk_assess_pkg()

    # OR by providing a path

    risk_result <- risk_assess_pkg(path/to/my/package)

## 2. Assessing via renv.lock

You can assess risks for all packages defined in an `renv.lock` or `pak.lock` file. This is helpful for auditing projects.

    # Assess based on renv.lock
    risk_result <- risk_assess_pkg("path/to/project/with/renv.lock") # or pak.lock

Note: This can be slow and is it better to run as a batch job or in CI (e.g., GitHub Actions).

## 3. Assessing a CRAN or Bioconductor Package

Use this method to check a remote package and version directly from public repositories.

# Assess the latest version from CRAN

    risk_result <- assess_pkg_r_package("stringr")

# Or a specific version

    risk_result <- assess_pkg_r_package("stringr", version = "1.5.0")

## Summary

These functions provide a consistent interface to assess risk for:

- Locally built packages
- renv or pak-based project dependencies
- Published open source packages from CRAN or Bioconductor

You can extend functionality by passing a custom `risk_config` to override default.

See more Here