typo3-site-conformance

TYPO3 Site / Project Conformance

Score and harden a deployable TYPO3 site distribution against the Netresearch gold standard. This is the site/project counterpart to typo3-conformance (which scopes to extensions).

When to use

• A repo with composer.json "type": "project" and a root Compose file.
• Reviewing container topology, Concourse CI, supply-chain gating, secret handling, or TYPO3 site config (config/system, config/sites).
• Bootstrapping a new customer site from the gold skeleton.

Extension repos (ext_emconf.php, Classes/, TER) → use typo3-conformance. Generic supply-chain hardening → enterprise-readiness; Docker/Compose → docker-development; Concourse → concourse-ci.

The ruleset

The rule catalogue and the executable checker are bundled in this skill — it needs no external checkout to run:

• Rules: checker/rules.json (machine-readable; generated by checker/gen_rules.py).
• Checker: checker/check.py — python3 checker/check.py <repo-path> (only pyyaml required). Scores a target repo and prints PASS/FAIL per rule.

typo3-14-gold is a runnable reference implementation that scores 100 %; typo3-project-standard is the human-readable companion. Both are Netresearch-internal and optional. Propose rule changes in gen_rules.py.

The seven rule families

Family	Intent
STRUCT	TYPO3-native layout: config/ at composer-project root, no build/config, config/sites/*/config.yaml, committed composer.lock, .gitignore excludes vendor/var/public + live-env files
CONTAINER	compose.yaml (not docker-compose.yml); images pinned — third-party by @sha256 digest or a non-floating tag (no :latest/:edge), first-party registry.netresearch.de images may track a floating tag (internal, trusted); healthchecks + deploy.resources.limits + restart on persistent services; no direct docker.sock mount
CI	composer audit → Trivy gate → SBOM → cosign; CI task images pinned; fly download checksum-verified; secret detection; test gate; updates via MR
DEPLOY	Valkey (auth + eviction + no persistence); ofelia scheduler via socket-proxy; weekly restore-verification; logs to stdout/stderr
DEP	declared PHP platform constraint; no dev-branch constraints; minimum-stability: stable; committed lock
SEC	no committed secrets (settings.php/additional.php secret-free, env-driven); no committed live-env files; no debug/host wildcards
DOC	AGENTS.md + CLAUDE.md→symlink; README documents setup/env/make

Workflow

1. Gate. Confirm type: project + root Compose. Otherwise N/A (extension → typo3-conformance).
2. Score. Run python3 checker/check.py <repo>, or evaluate the families above. ERROR blocks; WARN should fix; INFO advisory.
3. Scope. Architecture/estate/runtime rules (three-repo split, uptime, php-fpm status, ci-colocation) are advisory — report, don't gate.
4. Fix → re-score. Keep repo-scope rules at 100 %.

See references/migration-from-reference.md for transforming a legacy support/typo3-NN/app-style repo (app/ wrapper, build/config, committed secrets, Redis, :latest) into a conformant one. references/sealed-settings-php.md covers operating the read-only settings.php (complete ext-config key set; re-seal after checkout).