SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillstypo3-site-conformance

typo3-site-conformance

Deployment & operations

View repository

Updated 10-15 21:10

About this skill

TYPO3 Site / Project Conformance

Score and harden a deployable TYPO3 site distribution against the Netresearch gold standard. This is the site/project counterpart to typo3-conformance (which scopes to extensions).

When to use

  • A repo with composer.json "type": "project" and a root Compose file.
  • Reviewing container topology, Concourse CI, supply-chain gating, secret handling, or TYPO3 site config (config/system, config/sites).
  • Bootstrapping a new customer site from the gold skeleton.

Extension repos (ext_emconf.php, Classes/, TER) → use typo3-conformance. Generic supply-chain hardening → enterprise-readiness; Docker/Compose → docker-development; Concourse → concourse-ci.

The ruleset

The rule catalogue and the executable checker are bundled in this skill — it needs no external checkout to run:

  • Rules: checker/rules.json (machine-readable; generated by checker/gen_rules.py).
  • Checker: checker/check.py — python3 checker/check.py <repo-path> (only pyyaml required). Scores a target repo and prints PASS/FAIL per rule.

typo3-14-gold is a runnable reference implementation that scores 100 %; typo3-project-standard is the human-readable companion. Both are Netresearch-internal and optional. Propose rule changes in gen_rules.py.

The seven rule families

Family Intent
STRUCT TYPO3-native layout: config/ at composer-project root, no build/config, config/sites/*/config.yaml, committed composer.lock, .gitignore excludes vendor/var/public + live-env files
CONTAINER compose.yaml (not docker-compose.yml); images pinned — third-party by @sha256 digest or a non-floating tag (no :latest/:edge), first-party registry.netresearch.de images may track a floating tag (internal, trusted); healthchecks + deploy.resources.limits + restart on persistent services; no direct docker.sock mount
CI composer audit → Trivy gate → SBOM → cosign; CI task images pinned; fly download checksum-verified; secret detection; test gate; updates via MR
DEPLOY Valkey (auth + eviction + no persistence); ofelia scheduler via socket-proxy; weekly restore-verification; logs to stdout/stderr
DEP declared PHP platform constraint; no dev-branch constraints; minimum-stability: stable; committed lock
SEC no committed secrets (settings.php/additional.php secret-free, env-driven); no committed live-env files; no debug/host wildcards
DOC AGENTS.md + CLAUDE.md→symlink; README documents setup/env/make

Workflow

  1. Gate. Confirm type: project + root Compose. Otherwise N/A (extension → typo3-conformance).
  2. Score. Run python3 checker/check.py <repo>, or evaluate the families above. ERROR blocks; WARN should fix; INFO advisory.
  3. Scope. Architecture/estate/runtime rules (three-repo split, uptime, php-fpm status, ci-colocation) are advisory — report, don't gate.
  4. Fix → re-score. Keep repo-scope rules at 100 %.

See references/migration-from-reference.md for migrating a legacy support/typo3-NN/app repo (app/ wrapper, build/config, secrets, Redis, :latest). references/sealed-settings-php.md covers the read-only settings.php. references/database-seeds.md covers data/*.sql seeds with fixed uids: silent INSERT IGNORE, uid bands, translation pids.