Contact
Development

TYPO3 Site Conformance

Conformance and hardening for deployable TYPO3 v14 site/project repos (type:project + Docker/Compose): layout, Compose topology, Concourse CI, supply-chain gating (Trivy/SBOM/cosign), secret-free config, Valkey/ofelia runtime. Site/project counterpart to typo3-conformance.

Latest release v1.0.2

Install

Choose a supported route below. Package contents, agent registration and runtime dependencies can differ between installers.

  1. Claude Code via this marketplace 
    /plugin install typo3-site-conformance@netresearch-claude-code-marketplace

    First add the marketplace once in Claude Code: /plugin marketplace add netresearch/claude-code-marketplace. Then install the selected plugin. For setup and installation scopes, see Claude Code plugin setup A plugin can include several skills and additional components.

  2. npx interactive skill selection 
    npx skills add https://github.com/netresearch/typo3-site-conformance-skill

    Requires Node.js 22.20+. Run from the target project, then choose the source skills and agents in the installer. Uses the skills CLI from skills.sh Installs skill instructions. Extra plugin hooks, commands and external runtime tools are not installed by this route.

  3. composer require PHP project, as a package 
    composer require netresearch/typo3-site-conformance-skill

    Allow the Composer skill installer to activate and approve skill registration when prompted. Requires netresearch/composer-agent-skill-plugin Discovers trusted skill packages and registers their instructions in AGENTS.md. Runtime tools may need separate setup.

  4. composer skills:add PHP project, direct source 
    composer skills:add netresearch/typo3-site-conformance-skill

    Install and activate netresearch/composer-agent-skill-plugin first; approve the selected source's skill registration. Provided by netresearch/composer-agent-skill-plugin Pins source repositories without a Packagist package and records them in composer.skills.lock. Runtime dependencies remain separate.

What you can do with it

  • A repository has composer.json "type": "project" and a root Compose file (compose.yaml/docker-compose.yml).
  • You are reviewing or hardening container/Compose topology, a Concourse pipeline, supply-chain gating, or TYPO3 site config (config/system, config/sites).
  • You are forking the gold skeleton to start a new customer site, or migrating a legacy support/typo3-NN/app-style repo.

What you get back

  • A pass/fail conformance verdict per rule family (STRUCT, CONTAINER, CI, DEPLOY, DEP, SEC, DOC) with file:line evidence.
  • A prioritized remediation list (ERROR blocks, WARN should-fix, INFO advisory).
  • For migrations: the concrete seven-move transformation plan (references/migration-from-reference.md).

What it expects in your project

  • Read access to the target repository tree (composer.json, Dockerfile, compose*.yaml, ci/, config/system, config/sites, .gitlab-ci.yml, AGENTS.md).
  • python3 + pyyaml to run the bundled checker. Nothing else.

Tags

  • development
  • typo3