assess_reverse_dependencies(): don't depend on devtools::revdep()

devtools::revdep(bioconductor = TRUE) — the previous
implementation of assess_reverse_dependencies.default() —
internally calls devtools:::bioc_packages(), which
unconditionally reads a VIEWS file from
BiocManager::repositories()[['BioCsoft']]. On air-gapped
mirrors (for example, an internal Posit Package Manager
snapshot that only serves <repo>/src/contrib/PACKAGES), that
read fails with:

  cannot open the connection to
  '<mirror>/bioc-<snapshot>/latest/VIEWS'

The failure was silently converting the reverse-dependencies
metric to a pkg_metric_error for every package in a run, which
downstream tooling (riskreports) rendered as 'unknown'.

Compute reverse dependencies from utils::available.packages() +
tools::dependsOnPkgs() instead. That uses whatever's on
options('repos'), which works cleanly against both public
CRAN/Bioconductor and internal mirrors — no VIEWS file needed.

Expose three new arguments to make the behaviour explicit and
configurable:

  * repos        — defaults to getOption('repos')
  * dependencies — defaults to c('Depends', 'Imports',
                                 'LinkingTo', 'Suggests') to
                   match the previous devtools::revdep()
                   behaviour
  * available    — optional pre-computed available.packages()
                   matrix for callers that want to avoid a
                   repeated network fetch across many packages

Ships with three tests exercising the default expansion, the
dependencies filter, and the empty-result path, plus a NEWS
entry under the development version.

Author: aclark02-arcus

NAMESPACE

@@ -132,7 +132,6 @@ importFrom(covr,tally_coverage)
 importFrom(cranlogs,cran_downloads)
 importFrom(curl,nslookup)
 importFrom(devtools,check)
-importFrom(devtools,revdep)
 importFrom(httr,GET)
 importFrom(httr,content)
 importFrom(memoise,memoise)

NEWS.md

@@ -1,5 +1,29 @@
 # riskmetric (development version)
 
+- `assess_reverse_dependencies.default()` no longer calls
+  `devtools::revdep(bioconductor = TRUE)` internally. `devtools`'s
+  reverse-dependency helper unconditionally reads a `VIEWS` file
+  from `BiocManager::repositories()[["BioCsoft"]]`, which fails in
+  air-gapped environments — for example, an internal Posit Package
+  Manager mirror that serves `<repo>/src/contrib/PACKAGES` but no
+  `<repo>/VIEWS`. That failure was silently converting the
+  reverse-dependencies metric to a `pkg_metric_error` for every
+  package in the run, and downstream tooling (`riskreports`) then
+  rendered it as `"unknown"`.
+- The default method now computes the reverse-dependency list
+  from `utils::available.packages()` + `tools::dependsOnPkgs()`.
+  It accepts three new arguments to make the behaviour explicit
+  and configurable: `repos` (defaults to `getOption("repos")`),
+  `dependencies` (defaults to
+  `c("Depends", "Imports", "LinkingTo", "Suggests")` to match the
+  previous `devtools::revdep()` behaviour), and `available` (an
+  optional pre-computed `available.packages()` matrix to avoid a
+  repeated network fetch across many packages in the same
+  session). Public-network callers get the same result as before;
+  air-gapped callers can point `options(repos = ...)` at their
+  internal mirror once and expect the metric to populate
+  correctly.
+
 # riskmetric 0.2.6
 
 - Update to address new failing tests responding to `devtools` v2.4.7 changes.

R/assess_reverse_dependencies.R

@@ -1,22 +1,74 @@
 #' Generate list of Reverse Dependencies for a package
 #'
 #' @details The more packages that depend on a package the more chance
-#' for errors/bugs to be found
+#' for errors/bugs to be found.
+#'
+#' The default method computes the reverse-dependency list from an
+#' available-packages index (typically the CRAN and/or Bioconductor
+#' \code{PACKAGES} files reachable via \code{getOption("repos")}). This
+#' avoids the historical dependency on \code{devtools::revdep(bioconductor = TRUE)},
+#' which unconditionally reads a \code{VIEWS} file from
+#' \code{BiocManager::repositories()[["BioCsoft"]]}. That read fails in
+#' air-gapped environments (for example, an internal Posit Package
+#' Manager mirror that serves \code{<repo>/src/contrib/PACKAGES} but no
+#' \code{<repo>/VIEWS}), which caused the reverse-dependencies metric to
+#' silently degrade to a \code{pkg_metric_error} for every package in
+#' the run.
+#'
+#' Callers on the public network get the same result as before — the
+#' default \code{repos} value picks up whatever CRAN / Bioconductor
+#' mirrors are already configured — while callers on internal mirrors
+#' can point \code{repos} at those mirrors (or set
+#' \code{options(repos = ...)} once at the top of the session) and
+#' expect the metric to populate correctly.
 #'
 #' @eval roxygen_assess_family(
 #'   "reverse_dependencies",
 #'   "A character vector of reverse dependencies")
 #'
+#' @param repos Character vector of repository URLs to consult when
+#'   building the available-packages index. Defaults to
+#'   \code{getOption("repos")}. Ignored when \code{available} is
+#'   supplied.
+#' @param dependencies Character vector of dependency types to consider
+#'   when computing reverse dependencies. Defaults to
+#'   \code{c("Depends", "Imports", "LinkingTo", "Suggests")} to match
+#'   the previous \code{devtools::revdep()} behaviour.
+#' @param available Optional pre-computed matrix returned by
+#'   \code{\link[utils]{available.packages}}. Supplying it avoids a
+#'   repeated network fetch when the metric is computed for many
+#'   packages in the same session.
+#'
 #' @export
-assess_reverse_dependencies <- function(x, ...){
+assess_reverse_dependencies <- function(x, ...) {
   UseMethod("assess_reverse_dependencies")
 }
 
-#' @importFrom devtools revdep
+#' @rdname assess_reverse_dependencies
 #' @export
-assess_reverse_dependencies.default <- function(x, ...){
-  pkg_metric_eval(class = "pkg_metric_reverse_dependencies",
-                  devtools::revdep(x$name, bioconductor = TRUE)
+assess_reverse_dependencies.default <- function(
+  x,
+  ...,
+  repos        = getOption("repos"),
+  dependencies = c("Depends", "Imports", "LinkingTo", "Suggests"),
+  available    = NULL
+) {
+  pkg_metric_eval(
+    class = "pkg_metric_reverse_dependencies",
+    {
+      ap <- if (is.null(available)) {
+        utils::available.packages(repos = repos)
+      } else {
+        available
+      }
+      revs <- tools::dependsOnPkgs(
+        x$name,
+        dependencies = dependencies,
+        recursive    = FALSE,
+        installed    = ap
+      )
+      sort(unique(as.character(revs)))
+    }
   )
 }
 

tests/testthat/test_assess_reverse_dependencies.R

@@ -0,0 +1,81 @@
+test_that("assess_reverse_dependencies.default computes revdeps from available.packages()", {
+  # Build a fake CRAN-style available-packages matrix with three reverse
+  # dependents of the target package "target" (via Depends, Imports, and
+  # LinkingTo), plus one unrelated package.
+  fake_available <- matrix(
+    c(
+      "revA",     "1.0", "target",  "",         "",       "",
+      "revB",     "2.0", "",        "target",   "",       "",
+      "revC",     "3.0", "",        "",         "target", "",
+      "unrelated","0.1", "utils",   "",         "",       ""
+    ),
+    ncol  = 6,
+    byrow = TRUE,
+    dimnames = list(NULL, c("Package", "Version", "Depends",
+                            "Imports", "LinkingTo", "Suggests"))
+  )
+  # Package-level Repository column is required by tools::dependsOnPkgs
+  fake_available <- cbind(
+    fake_available,
+    Repository = "https://example.test/src/contrib"
+  )
+
+  x <- list(name = "target")
+  res <- assess_reverse_dependencies.default(x, available = fake_available)
+
+  expect_s3_class(res, "pkg_metric_reverse_dependencies")
+  expect_setequal(as.character(res), c("revA", "revB", "revC"))
+})
+
+test_that("assess_reverse_dependencies.default respects the `dependencies` filter", {
+  fake_available <- matrix(
+    c(
+      "revA",     "1.0", "target",  "",       "",       "",
+      "revB",     "2.0", "",        "target", "",       "",
+      "revC",     "3.0", "",        "",       "",       "target"
+    ),
+    ncol  = 6,
+    byrow = TRUE,
+    dimnames = list(NULL, c("Package", "Version", "Depends",
+                            "Imports", "LinkingTo", "Suggests"))
+  )
+  fake_available <- cbind(
+    fake_available,
+    Repository = "https://example.test/src/contrib"
+  )
+  x <- list(name = "target")
+
+  res_all <- assess_reverse_dependencies.default(
+    x,
+    available = fake_available,
+    dependencies = c("Depends", "Imports", "LinkingTo", "Suggests")
+  )
+  expect_setequal(as.character(res_all), c("revA", "revB", "revC"))
+
+  res_depends_only <- assess_reverse_dependencies.default(
+    x,
+    available = fake_available,
+    dependencies = "Depends"
+  )
+  expect_setequal(as.character(res_depends_only), "revA")
+})
+
+test_that("assess_reverse_dependencies.default returns an empty result cleanly", {
+  fake_available <- matrix(
+    c("unrelated", "0.1", "utils", "", "", ""),
+    ncol  = 6,
+    byrow = TRUE,
+    dimnames = list(NULL, c("Package", "Version", "Depends",
+                            "Imports", "LinkingTo", "Suggests"))
+  )
+  fake_available <- cbind(
+    fake_available,
+    Repository = "https://example.test/src/contrib"
+  )
+
+  x <- list(name = "target")
+  res <- assess_reverse_dependencies.default(x, available = fake_available)
+
+  expect_s3_class(res, "pkg_metric_reverse_dependencies")
+  expect_length(as.character(res), 0L)
+})