Gov.UK Notify. Email templates are not held as code.

[mikereiddigital]

User Story

As a Modernisation Platform Engineer I want to ensure that the content of Gov.UK Notify templates that we use as the basis for emails we send are held as source code in github. This removes the risk that templates are not altered either accidentally or maliciously outside of our code control processes.

Gov Notify is here - https://www.notifications.service.gov.uk/accounts. Everyone in the team should have been invited by @sukeshreddyg and so have access to it.

Currently, templates are mandatory & so this story is in two parts:

1. The existing templates amended so that the subject and the entire body as one or more placeholders, with email body formatting being done in the calling script rather than the template. We will also need to check what limits are in place with placeholders to allow this. Whilst this doesn't completely remove the use of templates, it avoids mistakes being accidentally added to templates during the editing process.

2. Investigate future releases of Notify as to whether templates will be made optional thus negating their need altogether. This being supported by their APIs is necessary.

Value / Purpose

Having email body kept as source control will give us assurance that we are reducing the risk of these emails including unintended content.

Context / Background

Our current use of Gov.UK Notify to send emails relies on templates that hold the title & body of the email with parameters being used to add personalised content. These templates are not managed in code & so there is the potential for changes to be added without any notification or additional checks.

Useful Contacts

Mike Reid

Additional Information

No response

Definition of Done

• Generic Template created that allows the title and the full body to be passed. Existing jobs amended & switched over to this template.
• Notify service checked for whether template-less emails will be supported in the future by the APIs.
• Review.

[ASTRobinson]

PR created to switch the confirm-environment-owner script to use a generic gov notify template containing only ((subject)) and ((message)) personalisation completed - #8989

Next steps are to move the other notify scripts to the generic template and then implement version checking against the template (which I think I have figured out a way of doing!)

[ASTRobinson]

testing version validation (incorrect template specified):

testing version validation (correct template specified):

[ASTRobinson]

PR created to add template version validation - #8992