Feat/typo3 demo environment

.github/workflows/docker-drupal.yml

@@ -53,13 +53,7 @@ jobs:
           images: |
             ghcr.io/${{ github.repository }}/drupal
           tags: |
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=sha,format=long,enable=${{ github.ref_type != 'tag' }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+            type=sha,format=long
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
@@ -76,6 +70,6 @@ jobs:
         with:
           context: app/drupal
           file: app/drupal/Dockerfile
-          push: ${{ github.event_name != 'pull_request' }}
+          push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/docker-typo3.yml

@@ -0,0 +1,75 @@
+name: Docker TYPO3
+
+on:
+  push:
+    branches: main
+    paths:
+      - app/typo3/**
+      - packages/ckeditor-plugin/**
+      - packages/typo3-ckeditor-plugin/**
+      - packages/editor/**
+      - .github/workflows/docker-typo3.yml
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    environment: Publish
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install pnpm package manager
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+
+      - name: Set up Node.js version
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          package-manager-cache: false
+
+      - name: Check for known security issues with npm packages
+        run: |
+          echo "Auditing npm dependencies before installing them. For more information, see: https://nldesignsystem.nl/pnpm-audit"
+          pnpm audit --audit-level critical
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      # The clippy extension in app/typo3/packages/clippy is generated, not committed, so it has to be
+      # built before the image is built.
+      - name: Build the TYPO3 extension
+        run: pnpm run build
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: |
+            ghcr.io/${{ github.repository }}/typo3
+          tags: |
+            type=sha,format=long
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: app/typo3
+          file: app/typo3/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.sonarcloud.properties

@@ -12,4 +12,4 @@ sonar.exclusions=**/index.html
 #sonar.sourceEncoding=UTF-8
 
 # Exclusions for copy-paste detection
-sonar.cpd.exclusions=**/index.html,**/*.test.ts,**/*.spec.ts,**/locales/*.ts,**/result-content.ts,**/question-content.ts
+sonar.cpd.exclusions=**/index.html,**/*.test.ts,**/*.spec.ts,**/locales/*.ts,**/result-content.ts,**/question-content.ts,app/**/wait-for-db.php

app/drupal/.dockerignore

@@ -56,8 +56,8 @@ tsconfig.tsbuildinfo
 *.der
 *.env
 *.key
-_.pem
-.env._
+*.pem
+.env.*
 
 # Example file exceptions
 

app/drupal/compose.yaml

@@ -20,7 +20,7 @@ services:
     restart: unless-stopped
 
   postgres:
-    image: postgres:16
+    image: postgres:16-alpine
     environment:
       POSTGRES_DB: ${POSTGRES_DB:-drupal}
       POSTGRES_USER: ${POSTGRES_USER:-drupal}

app/typo3/.dockerignore

@@ -0,0 +1,97 @@
+# See https://help.github.com/ignore-files/ for more about ignoring files.
+
+# Ignore 3rd party files
+
+node_modules/
+vendor/
+.npm/
+
+# Ignore generated files
+
+build/
+coverage/
+tmp/
+
+# NOTE: do not ignore dist/ as it is used in the CKEditor 5 plugin
+
+# Ignore archives
+
+**/*.7z
+**/*.dmg
+**/*.gz
+**/*.iso
+**/*.jar
+**/*.rar
+**/*.tar
+**/*.tgz
+**/*.zip
+
+# Cache
+
+.cache/
+tsconfig.tsbuildinfo
+
+# Ignore log files
+
+*.err
+*.log
+*.tmp
+
+# Code site files
+
+.idea/
+.vs/
+.vscode/
+.code-workspace/
+*.sublime-project
+*.sublime-workspace
+
+# Operating system files
+
+**/.DS_Store
+**/Thumbs.db
+
+# Files that (sometimes) contain secrets
+
+*.der
+*.env
+*.key
+*.pem
+.env.*
+
+# Example file exceptions
+
+!.env.example
+
+# Only track the pnpm lockfile in the root
+
+yarn.lock
+package-lock.json
+pnpm-lock.yaml
+
+# Ignore generated files from Stencil
+
+components.d.ts
+
+.github/copilot-instructions.md
+
+# Ignore generated files from Astro
+
+.astro/
+
+.claude
+
+# Version control
+
+.git
+.gitignore
+
+# Docker files themselves
+
+Dockerfile
+compose.yaml
+.dockerignore
+
+# Docs (not needed in the image)
+
+README.md

app/typo3/.env.example

@@ -0,0 +1,12 @@
+POSTGRES_DB=typo3
+POSTGRES_USER=typo3
+POSTGRES_PASSWORD=typo3
+TYPO3_SETUP_ADMIN_USERNAME=admin
+TYPO3_SETUP_ADMIN_PASSWORD=Password.1
+TYPO3_SETUP_ADMIN_EMAIL=admin@example.com
+TYPO3_PROJECT_NAME=NL Design System | typo3 demo environment
+TYPO3_BASE_URL=http://localhost:8082
+TYPO3_ENCRYPTION_KEY=insecure-local-dev-encryption-key
+TYPO3_TRUSTED_HOSTS_PATTERN=localhost(:[0-9]+)?
+# A password hash, not a plaintext password: `typo3 install:password:set --dry-run` prints one.
+TYPO3_INSTALL_TOOL_PASSWORD_HASH=

app/typo3/Dockerfile

@@ -0,0 +1,71 @@
+FROM php:8.4-apache
+
+COPY --from=composer:2 /usr/bin/composer /usr/local/bin/composer
+
+# intl is TYPO3's only requirement the base image lacks; pdo_pgsql, zip and gd are for postgres,
+# composer and image processing.
+RUN apt-get update \
+    && apt-get install --no-install-recommends --yes \
+        libfreetype6-dev \
+        libicu-dev \
+        libjpeg62-turbo-dev \
+        libpng-dev \
+        libpq-dev \
+        libzip-dev \
+    && docker-php-ext-configure gd --with-freetype --with-jpeg \
+    && docker-php-ext-install -j"$(nproc)" gd intl pdo_pgsql zip \
+    && rm -rf /var/lib/apt/lists/* \
+# The minimums TYPO3's environment check asks for.
+    && { \
+        echo 'memory_limit = 512M'; \
+        echo 'max_execution_time = 240'; \
+        echo 'max_input_vars = 1500'; \
+        echo 'upload_max_filesize = 32M'; \
+        echo 'post_max_size = 32M'; \
+    } > /usr/local/etc/php/conf.d/typo3.ini
+
+ENV COMPOSER_ALLOW_SUPERUSER=1
+
+RUN composer create-project typo3/cms-base-distribution:^14.3 /var/www/html --no-interaction --no-progress \
+    && composer clear-cache
+
+COPY packages/example/ /var/www/html/packages/example/
+COPY packages/clippy/dist/ /var/www/html/packages/clippy/
+RUN composer --working-dir=/var/www/html require --no-interaction --no-progress \
+        nl-design-system-community/example:@dev \
+        nl-design-system-community/clippy:@dev \
+    && composer clear-cache
+
+ENV TYPO3_CONTEXT=Production
+ENV TYPO3_BASE_URL=http://localhost:8082
+
+COPY setup.sh /usr/local/bin/setup.sh
+COPY check-install.php /usr/local/bin/check-install.php
+COPY wait-for-db.php /usr/local/bin/wait-for-db.php
+# Apache runs on 8080 so the process needs no root, and FallbackResource replaces the .htaccess the
+# installer writes into public/, which is not a volume and so does not survive a new container.
+RUN chmod +x /usr/local/bin/setup.sh \
+    && sed -i 's/Listen 80/Listen 8080/' /etc/apache2/ports.conf \
+    && printf '%s\n' \
+        '<VirtualHost *:8080>' \
+        '    DocumentRoot /var/www/html/public' \
+        '    FallbackResource /index.php' \
+        '</VirtualHost>' \
+        > /etc/apache2/sites-available/000-default.conf \
+    && echo "ServerName localhost" >> /etc/apache2/apache2.conf \
+    # Docker creates a missing mount point as root, which www-data may not write to.
+    && mkdir -p /var/www/html/config /var/www/html/public/fileadmin \
+    && chown -R www-data:www-data /var/log/apache2 /var/run/apache2 /var/www/html
+
+# settings.php stays writable because `typo3 setup` rewrites it; additional.php holds what must not
+# drift and stays root-owned. sites/ is kept outside config/ so startup can restore it after install.
+COPY config/ /var/www/html/config/
+COPY config/sites/ /usr/local/share/typo3/sites/
+RUN chown -R www-data:www-data /var/www/html/config \
+    && chown root:root /var/www/html/config/system/additional.php \
+    && chmod 444 /var/www/html/config/system/additional.php
+
+USER www-data
+
+ENTRYPOINT ["/usr/local/bin/setup.sh"]
+CMD ["apache2-foreground"]