Software development
Build, test and deploy services at Defra.
This section covers how to build a service at Defra: the standards you follow, the platform you build on and the technologies you can use.
It builds on the GOV.UK Service Standard and the technology section of the GOV.UK Service Manual. The Technology Code of Practice sets out the criteria government uses to design, build and buy technology.
If you work in an architecture role, see architecture.
Follow this guidance when you are:
- building a GOV.UK digital service
- building an internal digital service at Defra
This guidance may not apply if you are:
- deploying commercial off-the-shelf software
- building a data or reporting platform
Getting started
To get started, you should:
- Review the Defra software development standards
- these are mandatory, and the Delivery Architecture team handles any exceptions through their governance process
- they set out Defra's supported languages and frameworks, and the context behind each choice
- they include guides for common development patterns, such as Defra Identity integration, Microsoft Entra integration and a GDPR-compliant cookie banner
- they cover secure coding practices, including how to protect your service with GitHub Advanced Security
- Work with your architect to determine whether the Core Delivery Platform (CDP) is a fit for your service
- CDP is Defra's internal development platform, with build pipelines, hosting, logging and monitoring already in place
- the expectation is that it will be a fit, and anything else is managed as an exception through the Delivery Architecture team's governance process
Expected approach
When you build a service, you are expected to:
- build on the Core Delivery Platform
- use Defra's approved technologies and languages
- use Defra's common tools as part of your service
- code in the open from the start, storing code in the Defra GitHub organisation
- analyse code in the Defra SonarQube Cloud organisation
- follow Defra's README standards
- maintain application architecture documentation and architecture decision records
- work with your architect on the design of the service, and on decisions that affect other services
- work with your quality assurance (QA) colleagues to shift testing left, checking designs and code as you build rather than at the end
- meet the GOV.UK Service Standard and the Technology Code of Practice
Approved technologies and languages
Defra restricts the languages and frameworks you can use. This means we can recruit and train against a common stack, and support services over the long term. You should:
- use Node.js with the Hapi framework for frontend and backend services
- only consider .NET or Python for workloads where Node.js is not suitable
- use the GOV.UK Frontend Nunjucks templates to build your pages
- not use other frontend frameworks like Vue or React
- use vanilla JavaScript
The Defra software development standards give more detail on each of these choices. If you need a technology that is not on the list, use the Defra Tools Radar on Jira to review approved technologies and request new ones.
Common tools
| Tool | Description |
|---|---|
| Core Delivery Platform | Defra's internal development platform for building, deploying and running services |
| Defra Customer Identity | External authentication and authorisation |
| Defra Forms | Accessible forms that follow GOV.UK standards |
| Defra Interactive Map | Accessible frontend mapping component |
Get support
If you need help building your service, ask the principal developers in the Defra Digital Team Slack.
- Slack: ask-principal-developers