Overview
GOV.UK Notify API is the backend service powering GOV.UK Notify. Contributions should maintain high code quality, security standards, and alignment with government service design principles.Before You Start
Required Reading
- Local Development Setup - Get your environment configured
- Running Tests - Understand the testing approach
- Writing Public APIs - Public API guidelines
Access Requirements
- GitHub account with access to alphagov/notifications-api
- AWS credentials for local development (see Wiki)
- Access to the credentials repository for API keys
Code Standards
Python Version
All code must be compatible with Python 3.13.Code Style
We use Ruff for linting and formatting:Type Hints
Use type hints for all function signatures. We use mypy for static type checking:Pre-commit Hooks
All commits must pass pre-commit hooks:- Remove trailing whitespace
- Fix end-of-file issues
- Validate YAML files
- Detect debug statements
- Run Ruff linting and formatting
Development Workflow
1. Create a Feature Branch
feature/- New featuresfix/- Bug fixesrefactor/- Code refactoringdocs/- Documentation updates
2. Make Your Changes
Follow the project structure:3. Write Tests
All changes require tests:- New features: Comprehensive unit tests
- Bug fixes: Regression tests
- Refactoring: Maintain existing coverage
4. Update Documentation
If your changes affect:- Public APIs: Update client documentation and API docs
- Configuration: Update setup documentation
- Developer workflows: Update this guide
5. Run the Full Test Suite
Before creating a pull request:- All tests pass
- Linting passes
- Type checking passes
- No new warnings
6. Commit Your Changes
Write clear, descriptive commit messages:- First line: Brief summary (50 chars or less)
- Blank line
- Detailed description of changes
- Reference related issues
7. Push and Create Pull Request
- Clear title describing the change
- Description of what changed and why
- Link to related issues
- Screenshots (if UI changes)
- Testing instructions
Public API Guidelines
When creating or modifying public API endpoints:File Structure
Each endpoint should be in its own file:Blueprint Registration
Create blueprints in__init__.py:
Error Handling
Public APIs use different error handling than internal endpoints:Authentication
Specify authentication inapp/__init__.py:
Client Support
All public API endpoints must:- Have adapters in all client libraries (Python, Ruby, Java, .NET, Node.js, PHP)
- Be documented in client documentation
- Be documented in the technical documentation
Database Changes
Migrations
Create database migrations using Flask-Migrate:Migration Guidelines
- Always review auto-generated migrations
- Test migrations both up and down
- Consider impact on production (data volume, locking)
- Use
op.batch_alter_table()for SQLite compatibility in tests
SQL Review
For complex migrations, usesquawk-cli to check for issues:
Dependency Management
Adding Dependencies
Add dependencies to.in files:
Updating Dependencies
See the Dependencies Wiki for detailed guidance. Update notifications-utils:Security
Security Considerations
- Never commit secrets or API keys
- Use environment variables for sensitive data
- Validate all user inputs
- Sanitize data before database queries
- Follow OWASP guidelines for web applications
Secrets Management
- Store secrets in AWS Secrets Manager
- Use
environment.shfor local development (git-ignored) - Never hardcode credentials
Testing Requirements
Unit Tests
All code changes require tests:Integration Tests
Test interactions between components:Mocking External Services
Always mock external services:Code Review
All pull requests require code review:Reviewers Should Check
- Code follows style guidelines
- Tests are comprehensive
- Documentation is updated
- No security vulnerabilities
- Performance implications considered
- Backward compatibility maintained
Submitters Should
- Respond to feedback promptly
- Make requested changes
- Explain reasoning for decisions
- Keep pull requests focused and small
Deployment
Pre-deployment Checks
- All tests pass in CI/CD
- Database migrations reviewed
- Feature flags configured (if applicable)
- Rollback plan documented
Migration Safety
Check for pending migrations:Getting Help
Resources
- Notify Manuals Wiki
- GOV.UK Notify Team
- Internal team Slack channels
Common Issues
See Troubleshooting in the setup guide.Release Process
The team follows a continuous deployment model:- Changes merge to
main - Automated tests run in Concourse
- Successful builds deploy to staging
- Manual promotion to production