TYPO3 Site / Project Conformance
Score and harden a deployable TYPO3 site distribution against the Netresearch
gold standard. This is the site/project counterpart to typo3-conformance
(which scopes to extensions).
When to use
- A repo with
composer.json "type": "project" and a root Compose file.
- Reviewing container topology, Concourse CI, supply-chain gating, secret
handling, or TYPO3 site config (
config/system, config/sites).
- Bootstrapping a new customer site from the gold skeleton.
Extension repos (ext_emconf.php, Classes/, TER) → use typo3-conformance.
Generic supply-chain hardening → enterprise-readiness; Docker/Compose →
docker-development; Concourse → concourse-ci.
The ruleset
The rule catalogue and the executable checker are bundled in this skill — it
needs no external checkout to run:
- Rules:
checker/rules.json (machine-readable; generated by
checker/gen_rules.py).
- Checker:
checker/check.py — python3 checker/check.py <repo-path>
(only pyyaml required). Scores a target repo and prints PASS/FAIL per rule.
typo3-14-gold is a runnable reference implementation that scores 100 %;
typo3-project-standard is the human-readable companion. Both are
Netresearch-internal and optional. Propose rule changes in gen_rules.py.
The seven rule families
| Family |
Intent |
STRUCT |
TYPO3-native layout: config/ at composer-project root, no build/config, config/sites/*/config.yaml, committed composer.lock, .gitignore excludes vendor/var/public + live-env files |
CONTAINER |
compose.yaml (not docker-compose.yml); images pinned — third-party by @sha256 digest or a non-floating tag (no :latest/:edge), first-party registry.netresearch.de images may track a floating tag (internal, trusted); healthchecks + deploy.resources.limits + restart on persistent services; no direct docker.sock mount |
CI |
composer audit → Trivy gate → SBOM → cosign; CI task images pinned; fly download checksum-verified; secret detection; test gate; updates via MR |
DEPLOY |
Valkey (auth + eviction + no persistence); ofelia scheduler via socket-proxy; weekly restore-verification; logs to stdout/stderr |
DEP |
declared PHP platform constraint; no dev-branch constraints; minimum-stability: stable; committed lock |
SEC |
no committed secrets (settings.php/additional.php secret-free, env-driven); no committed live-env files; no debug/host wildcards |
DOC |
AGENTS.md + CLAUDE.md→symlink; README documents setup/env/make |
Workflow
- Gate. Confirm
type: project + root Compose. Otherwise N/A (extension → typo3-conformance).
- Score. Run
python3 checker/check.py <repo>, or evaluate the families above. ERROR blocks; WARN should fix; INFO advisory.
- Scope. Architecture/estate/runtime rules (three-repo split, uptime, php-fpm status, ci-colocation) are advisory — report, don't gate.
- Fix → re-score. Keep repo-scope rules at 100 %.
See references/migration-from-reference.md for migrating a legacy
support/typo3-NN/app repo (app/ wrapper, build/config, secrets, Redis,
:latest). references/sealed-settings-php.md covers the read-only
settings.php. references/database-seeds.md covers data/*.sql seeds with
fixed uids: silent INSERT IGNORE, uid bands, translation pids.
1---2name: typo3-site-conformance3description: Use when assessing or hardening a deployable TYPO3 SITE/PROJECT repo (composer type:project + Docker/Compose) — not an extension. Triggers on: compose.yaml/docker-compose.yml + config/sites or config/system in a TYPO3 repo, site conformance, gold standard, project conformance, container/Compose topology, Concourse pipeline review, supply-chain (Trivy/SBOM/cosign), secret-free settings.php/additional.php, Valkey cache, ofelia scheduler, image digest pinning, .gitlab-ci validate-only. For EXTENSION quality use typo3-conformance instead.4---56# TYPO3 Site / Project Conformance78Score and harden a **deployable TYPO3 site distribution** against the Netresearch9gold standard. This is the **site/project** counterpart to `typo3-conformance`10(which scopes to *extensions*).1112## When to use1314- A repo with `composer.json` `"type": "project"` **and** a root Compose file.15- Reviewing container topology, Concourse CI, supply-chain gating, secret16 handling, or TYPO3 site config (`config/system`, `config/sites`).17- Bootstrapping a new customer site from the gold skeleton.1819Extension repos (`ext_emconf.php`, `Classes/`, TER) → use **`typo3-conformance`**.20Generic supply-chain hardening → **`enterprise-readiness`**; Docker/Compose →21**`docker-development`**; Concourse → **`concourse-ci`**.2223## The ruleset2425The rule catalogue and the executable checker are **bundled in this skill** — it26needs no external checkout to run:2728- **Rules:** `checker/rules.json` (machine-readable; generated by29 `checker/gen_rules.py`).30- **Checker:** `checker/check.py` — `python3 checker/check.py <repo-path>`31 (only `pyyaml` required). Scores a target repo and prints PASS/FAIL per rule.3233`typo3-14-gold` is a runnable **reference implementation** that scores 100 %;34`typo3-project-standard` is the human-readable companion. Both are35Netresearch-internal and optional. Propose rule changes in `gen_rules.py`.3637## The seven rule families3839| Family | Intent |40|--------|--------|41| `STRUCT` | TYPO3-native layout: `config/` at composer-project root, no `build/config`, `config/sites/*/config.yaml`, committed `composer.lock`, `.gitignore` excludes vendor/var/public + live-env files |42| `CONTAINER` | `compose.yaml` (not `docker-compose.yml`); images pinned — third-party by `@sha256` digest or a non-floating tag (no `:latest`/`:edge`), first-party `registry.netresearch.de` images may track a floating tag (internal, trusted); healthchecks + `deploy.resources.limits` + `restart` on persistent services; no direct `docker.sock` mount |43| `CI` | composer audit → Trivy gate → SBOM → cosign; CI task images pinned; fly download checksum-verified; secret detection; test gate; updates via MR |44| `DEPLOY` | Valkey (auth + eviction + no persistence); ofelia scheduler via socket-proxy; weekly restore-verification; logs to stdout/stderr |45| `DEP` | declared PHP platform constraint; no dev-branch constraints; `minimum-stability: stable`; committed lock |46| `SEC` | no committed secrets (settings.php/additional.php secret-free, env-driven); no committed live-env files; no debug/host wildcards |47| `DOC` | `AGENTS.md` + `CLAUDE.md`→symlink; `README` documents setup/env/make |4849## Workflow50511. **Gate.** Confirm `type: project` + root Compose. Otherwise N/A (extension → `typo3-conformance`).522. **Score.** Run `python3 checker/check.py <repo>`, or evaluate the families above. ERROR blocks; WARN should fix; INFO advisory.533. **Scope.** Architecture/estate/runtime rules (three-repo split, uptime, php-fpm status, ci-colocation) are *advisory* — report, don't gate.544. **Fix → re-score.** Keep repo-scope rules at 100 %.5556See `references/migration-from-reference.md` for migrating a legacy57`support/typo3-NN/app` repo (app/ wrapper, `build/config`, secrets, Redis,58`:latest`). `references/sealed-settings-php.md` covers the read-only59`settings.php`. `references/database-seeds.md` covers `data/*.sql` seeds with60fixed uids: silent `INSERT IGNORE`, uid bands, translation pids.
dirnbauer