A scraper depends on more than the code that extracts records. Its build also depends on packages, installation steps, and the environment used to run them. Those choices deserve review while an Actor is still being developed.
For BatScrape’s upcoming Actors, our aim is to make dependency changes explicit and reproducible. This is a development checklist, not a security certification.
Ask why the package is needed
Record the job a new dependency performs. Consider whether it duplicates an existing capability, how it is maintained, and how its license fits the project. A familiar package name is not a substitute for checking the actual version being added.
Understand installation behavior
Some dependencies perform work during installation. Review the package manager’s current controls and determine which build steps are necessary for the project. Avoid assuming that every Actor has the same requirements.
Keep the chosen configuration in version control so reviewers can see when installation behavior changes.
Verify the resulting build
After a dependency change, build from the lockfile and exercise the affected scraping path with representative examples. Check that optional functionality still works in the intended runtime.
These steps do not remove every supply-chain risk. They make the decisions visible and give a reviewer something concrete to inspect before a release.
BatScrape Team
Building BatScrape
