chore: promote develop to staging

.github/workflows/publish-develop.yml

@@ -2,7 +2,7 @@ name: Publish develop
 
 on:
   pull_request:
-    branches: [ main, staging ]
+    branches: [ develop, main, staging ]
   push:
     branches:
       - staging

.github/workflows/quality-checks.yml

@@ -42,7 +42,14 @@ jobs:
         run: uv run pytest -m api --no-cov
 
       - name: Dagster startup smoke test
-        run: uv run pytest -m integration -k test_dagster_startup --no-cov
+        env:
+          # Match dagster.yaml (env-based storage/logs); runner has no Docker .env defaults.
+          DAGSTER_HOME: ${{ github.workspace }}
+          DAGSTER_STORAGE_DIR: ${{ github.workspace }}/tmp_dagster/storage
+          DAGSTER_LOGS_DIR: ${{ github.workspace }}/tmp_dagster/logs
+        run: |
+          mkdir -p "$DAGSTER_STORAGE_DIR" "$DAGSTER_LOGS_DIR"
+          uv run pytest -m integration -k test_dagster_startup --no-cov
 
   dbt-check:
     runs-on: ubuntu-latest

.gitignore

@@ -79,6 +79,12 @@ PR.md
 PR.txt
 TODO.md
 
+# CI ephemeral Dagster dirs (quality-checks sets DAGSTER_* under repo root)
+tmp_dagster/
+
+# Maintainer-only / local audit notes (do not commit)
+docs/READINESS-AUDIT.md
+
 # Local
 .actrc
 .mcp.json

README.md

@@ -21,17 +21,17 @@ It analyzes open-source projects and matches them to contributors — so you fin
 ## Getting Started
 
 ```bash
-cp .env.example .env              # configure environment
-make setup                        # install deps + compile Go binaries
-npm ci                            # Prisma / ts-node (package.json is in-repo)
-docker compose up --build -d      # start services (Dagster UI at :3000)
-make db-init                      # apply schema + seed data
-make ci-check                     # same Python gates as GitHub Actions (before a PR)
+cp .env.example .env              # set DATABASE_URL, tokens, optional host ports (see file + AGENTS.md)
+make setup                        # uv sync + compile Go binaries
+npm ci                            # Prisma / Node (needed before db-init)
+docker compose up --build -d      # Dagster + API + db (default host: Dagster :3000, API :8000 unless overridden in .env)
+make db-init                      # Prisma schema + seed
+make ci-check                     # Python parity with CI quality job (before a PR); full CI is broader — see AGENTS.md
 ```
 
 ## Contributing
 
-Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for how to propose changes, run checks, and open PRs. A maintainer-facing [readiness audit](docs/READINESS-AUDIT.md) covers OSS posture, security, CI, and recommendations pipeline health.
+See [CONTRIBUTING.md](CONTRIBUTING.md) (branch flow, conventions, **`make ci-check`**). For command cheat-sheets (**dbt**, API, Docker overrides), see [AGENTS.md](AGENTS.md).
 
 ## License
 

pyproject.toml

@@ -19,7 +19,7 @@ dependencies = [
     "pydantic>=2.0.0,<3",
     "pgvector>=0.4.1,<0.5",
     "python-dotenv>=1.1.1,<2",
-    "requests>=2.31.0,<3",
+    "requests>=2.33.0,<3",
     "dagster>=1.12.17,<2",
     "dagster-webserver>=1.12.17,<2",
     "dagster-postgres>=0.28.17,<0.29",
@@ -47,7 +47,7 @@ Issues = "https://github.com/opensource-together/ost-linker/issues"
 [dependency-groups]
 dev = [
     "ruff>=0.12.0,<0.13",
-    "pytest>=8.4.1,<9",
+    "pytest>=9.0.3,<10",
     "pytest-cov>=6.0.0,<7",
     "pytest-dotenv>=0.5.2,<0.6",
     "faker>=26.0.0,<27",
@@ -71,6 +71,16 @@ build-backend = "hatchling.build"
 [tool.hatch.build.targets.wheel]
 packages = ["src"]
 
+[tool.uv]
+# Security: minimum patched versions for transitive deps (see `uv run pip-audit`).
+constraint-dependencies = [
+    "cryptography>=46.0.7",
+    "deepdiff>=8.6.2",
+    "pygments>=2.20.0",
+    "pyjwt>=2.12.0",
+    "pip>=26.1",
+]
+
 [tool.dagster]
 module_name = "src.linker.definitions"