# Typo3 Site Conformance

> Use when assessing or hardening a deployable TYPO3 SITE/PROJECT repo (composer type:project + Docker/Compose) — not an extension. Triggers on: compose.yaml/docker-compose.yml + config/sites or config/system in a TYPO3 repo, site conformance, gold standard, project conformance, container/Compose topology, Concourse pipeline review, supply-chain (Trivy/SBOM/cosign), secret-free settings.php/additional.php, Valkey cache, ofelia scheduler, image digest pinning, .gitlab-ci validate-only. For EXTENSION quality use typo3-conformance instead.

- Skill: `dirnbauer/typo3-site-conformance` (Agent Skill, multi-file: 11 files)
- Install (CLI): `npx skillmds@latest add dirnbauer/typo3-site-conformance`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dirnbauer/typo3-site-conformance/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: dirnbauer (https://skillmd.com/u/dirnbauer)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/dirnbauer/typo3-site-conformance

---


# TYPO3 Site / Project Conformance

Score and harden a **deployable TYPO3 site distribution** against the Netresearch
gold standard. This is the **site/project** counterpart to `typo3-conformance`
(which scopes to *extensions*).

## When to use

- A repo with `composer.json` `"type": "project"` **and** a root Compose file.
- Reviewing container topology, Concourse CI, supply-chain gating, secret
  handling, or TYPO3 site config (`config/system`, `config/sites`).
- Bootstrapping a new customer site from the gold skeleton.

Extension repos (`ext_emconf.php`, `Classes/`, TER) → use **`typo3-conformance`**.
Generic supply-chain hardening → **`enterprise-readiness`**; Docker/Compose →
**`docker-development`**; Concourse → **`concourse-ci`**.

## The ruleset

The rule catalogue and the executable checker are **bundled in this skill** — it
needs no external checkout to run:

- **Rules:** `checker/rules.json` (machine-readable; generated by
  `checker/gen_rules.py`).
- **Checker:** `checker/check.py` — `python3 checker/check.py <repo-path>`
  (only `pyyaml` required). Scores a target repo and prints PASS/FAIL per rule.

`typo3-14-gold` is a runnable **reference implementation** that scores 100 %;
`typo3-project-standard` is the human-readable companion. Both are
Netresearch-internal and optional. Propose rule changes in `gen_rules.py`.

## The seven rule families

| Family | Intent |
|--------|--------|
| `STRUCT` | TYPO3-native layout: `config/` at composer-project root, no `build/config`, `config/sites/*/config.yaml`, committed `composer.lock`, `.gitignore` excludes vendor/var/public + live-env files |
| `CONTAINER` | `compose.yaml` (not `docker-compose.yml`); images pinned — third-party by `@sha256` digest or a non-floating tag (no `:latest`/`:edge`), first-party `registry.netresearch.de` images may track a floating tag (internal, trusted); healthchecks + `deploy.resources.limits` + `restart` on persistent services; no direct `docker.sock` mount |
| `CI` | composer audit → Trivy gate → SBOM → cosign; CI task images pinned; fly download checksum-verified; secret detection; test gate; updates via MR |
| `DEPLOY` | Valkey (auth + eviction + no persistence); ofelia scheduler via socket-proxy; weekly restore-verification; logs to stdout/stderr |
| `DEP` | declared PHP platform constraint; no dev-branch constraints; `minimum-stability: stable`; committed lock |
| `SEC` | no committed secrets (settings.php/additional.php secret-free, env-driven); no committed live-env files; no debug/host wildcards |
| `DOC` | `AGENTS.md` + `CLAUDE.md`→symlink; `README` documents setup/env/make |

## Workflow

1. **Gate.** Confirm `type: project` + root Compose. Otherwise N/A (extension → `typo3-conformance`).
2. **Score.** Run `python3 checker/check.py <repo>`, or evaluate the families above. ERROR blocks; WARN should fix; INFO advisory.
3. **Scope.** Architecture/estate/runtime rules (three-repo split, uptime, php-fpm status, ci-colocation) are *advisory* — report, don't gate.
4. **Fix → re-score.** Keep repo-scope rules at 100 %.

See `references/migration-from-reference.md` for migrating a legacy
`support/typo3-NN/app` repo (app/ wrapper, `build/config`, secrets, Redis,
`:latest`). `references/sealed-settings-php.md` covers the read-only
`settings.php`. `references/database-seeds.md` covers `data/*.sql` seeds with
fixed uids: silent `INSERT IGNORE`, uid bands, translation pids.