Improve third_party readme

third_party/README.md

@@ -25,6 +25,16 @@ gRPC depends on several third-party libraries, their source code is available
   Also keep in mind that adding a new dependency can be quite disruptive 
   for the users and community - it means that all users will need to update their projects accordingly (for C++ projects often non-trivial) and 
   the community-provided C++ packages (e.g. vcpkg) will need to be updated as well.
+  
+## Checklist for adding a new third-party dependency
+
+**READ THIS BEFORE YOU ADD A NEW DEPENDENCY**
+
+- [ ] Make sure you understand the hidden costs of adding a dependency (see section above) and that you understand the     complexities of updating the build files. Maintenance of the build files isn't for free, so expect to be involved in maintenance tasks, cleanup and support (e.g resolving user bugs) of the build files in the future.
+
+- [ ] Once your change is ready, start an [adhoc run of artifact - packages - distribtests flow](https://fusion.corp.google.com/projectanalysis/summary/KOKORO/prod%3Agrpc%2Fcore%2Fexperimental%2Fgrpc_build_artifacts_multiplatform) and make sure everything passes (for technical reasons, not all the distribtests can run on each PR automatically).
+
+- [ ] Check the impact of the new dependency on the size of our distribution packages (compare BEFORE and AFTER) and post the comparison on your PR (it should not be approved without checking the impact sizes of packages first). The package sizes AFTER can be obtained from the adhoc package build from bullet point above.
 
 ## Instructions for updating dependencies
 
@@ -34,6 +44,7 @@ Usually the process is
 2. update the dependency in `grpc_deps.bzl` to the same commit
 3. update `tools/run_tests/sanity/check_submodules.sh` to make the sanity test pass
 4. (when needed) run `tools/buildgen/generate_projects.sh` to regenerate the generated files 
+5. populate the bazel download mirror by running `bazel/update_mirror.sh`
 
 Updating some dependencies requires extra care.