Typo3 site conformance

Skill netresearch/typo3-site-conformance-skill/skills/typo3-site-conformance

TYPO3 site/project conformance skill — deployable repos (type:project + Docker/Compose): layout, containers, Concourse CI, supply-chain, secrets, Valkey/ofelia. Sibling to typo3-conformance.

Install

npx -y skills add netresearch/typo3-site-conformance-skill --skill typo3-site-conformance

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when assessing or hardening a deployable TYPO3 SITE/PROJECT repo (composer type:project + Docker/Compose) — not an extension. Triggers on: compose.yaml/docker-compose.yml + config/sites or config/system in a TYPO3 repo, site conformance, gold standard, project conformance, container/Compose topology, Concourse pipeline review, supply-chain (Trivy/SBOM/cosign), secret-free settings.php/additional.php, Valkey cache, ofelia scheduler, image digest pinning, .gitlab-ci validate-only. For EXTENSION quality use typo3-conformance instead.

SKILL.md

4.1 KB, as published. Nobody here has run it

TYPO3 Site / Project Conformance

Score and harden a deployable TYPO3 site distribution against the Netresearch gold standard. This is the site/project counterpart to typo3-conformance (which scopes to extensions).

When to use

A repo with composer.json "type": "project" and a root Compose file.
Reviewing container topology, Concourse CI, supply-chain gating, secret handling, or TYPO3 site config (config/system, config/sites).
Bootstrapping a new customer site from the gold skeleton.

Extension repos (ext_emconf.php, Classes/, TER) → use typo3-conformance. Generic supply-chain hardening → enterprise-readiness; Docker/Compose → docker-development; Concourse → concourse-ci.

The ruleset

The rule catalogue and the executable checker are bundled in this skill — it needs no external checkout to run:

Rules: checker/rules.json (machine-readable; generated by checker/gen_rules.py).
Checker: checker/check.py — python3 checker/check.py <repo-path> (only pyyaml required). Scores a target repo and prints PASS/FAIL per rule.

typo3-14-gold is a runnable reference implementation that scores 100 %; typo3-project-standard is the human-readable companion. Both are Netresearch-internal and optional. Propose rule changes in gen_rules.py.

The seven rule families

Family	Intent
`STRUCT`	TYPO3-native layout: `config/` at composer-project root, no `build/config`, `config/sites/*/config.yaml`, committed `composer.lock`, `.gitignore` excludes vendor/var/public + live-env files
`CONTAINER`	`compose.yaml` (not `docker-compose.yml`); images pinned — third-party by `@sha256` digest or a non-floating tag (no `:latest`/`:edge`), first-party `registry.netresearch.de` images may track a floating tag (internal, trusted); healthchecks + `deploy.resources.limits` + `restart` on persistent services; no direct `docker.sock` mount
`CI`	composer audit → Trivy gate → SBOM → cosign; CI task images pinned; fly download checksum-verified; secret detection; test gate; updates via MR
`DEPLOY`	Valkey (auth + eviction + no persistence); ofelia scheduler via socket-proxy; weekly restore-verification; logs to stdout/stderr
`DEP`	declared PHP platform constraint; no dev-branch constraints; `minimum-stability: stable`; committed lock
`SEC`	no committed secrets (settings.php/additional.php secret-free, env-driven); no committed live-env files; no debug/host wildcards
`DOC`	`AGENTS.md` + `CLAUDE.md`→symlink; `README` documents setup/env/make

Workflow

Gate. Confirm type: project + root Compose. Otherwise N/A (extension → typo3-conformance).
Score. Run python3 checker/check.py <repo>, or evaluate the families above. ERROR blocks; WARN should fix; INFO advisory.
Scope. Architecture/estate/runtime rules (three-repo split, uptime, php-fpm status, ci-colocation) are advisory — report, don't gate.
Fix → re-score. Keep repo-scope rules at 100 %.

See references/migration-from-reference.md for transforming a legacy support/typo3-NN/app-style repo (app/ wrapper, build/config, committed secrets, Redis, :latest) into a conformant one. references/sealed-settings-php.md covers operating the read-only settings.php (complete ext-config key set; re-seal after checkout).