WP1877: Upgrade GOV.UK publishing applications and a discovery into dependency management processes

Tender description

Why the Work is Being Done Implement a more secure, stable and scalable platform in line with innovation. Strand 1:Development work 1a:Upgrade up to 45 applications to Rails 6. Mini investigation to confirm approach and scope (no greater than 160 days) 1b:Upgrade up to 65 applications to upgrade to Ruby 2.7. Much of this of this work is automated but ultimately applications need to be hard restarted to pick up the new ruby versions so a formal roll out possess needs to be in place and co-ordinated with GOV.UK technical support (5-7 days) Strand 2:Discovery (7-10 days) We would like the supplier to conduct a mini discovery/technical spike into options and delivery recommendations for dependency management that minimises manual intervention while balancing our desire to stay up to date, but not fall foul of bleeding edge vulnerabilities for the GOV.UK platform suite of micro-service (between 60-70 apps) applications running on Ruby on Rails technologies. This should include what applications and processes are impacted and make recommendations about options and best practise for us to reduce the oversight and burden the technical team currently undertake to support these in order to drive efficiencies and reduce technical overheads in regards the management of the GOV.UK platform. Problem to Be Solved The GOV.UK Technology suite needs to be kept up to date to mitigate risks around security, vulnerability and interoperability. It is also important that GOV.UK is enabled for new technology developments. Reducing any technology overheads and manual burdens within the dependancy management system also mitigates risk of security and human error whilst allowing the tech team to be as efficient as possible. Who Are the Users 1a & 1b As a Technical owner of GOV.UK I need to ensure our platforms are up to date So that our environment and the citizen facing website is stable and reliable and that the developers who work on GOV.UK can interoperate with other services and new technologies. 2. As a developer on GOV.UK I need to have a process and the tooling to update dependencies on my applications in a way that minimises the workload across all applications So that we can help ensure our applications are secure, performant, and And so that time is being spent efficiently Early Market Engagement None. Work Already Done We've started doing the Rails upgrades but have made limited progress on the 45 applications in scope. Initial conversations regarding the issue of dependency updates in general, but there's no formal "discovery" been done. Existing Team The supplier will predominantly be working with The GOV.UK Head of Tech and GOV.UK Tech Leads. Current Phase Not started Work Location The team are based at The Whitechapel Building in Aldgate in London. Working Arrangments The supplier can primarily work remotely and work with the teams via digital communication methods. The existing team of GOV.UK developers will be available to review Pull Requests and answer questions on undocumented application behaviour. They will specify the versions of dependencies to be upgraded at the time the engagement begins. The work will be co-ordinated by a GOV.UK Delivery Manager and overseen by a GOV.UK Senior Technologist. It would be beneficial for the supplier to be onsite for key workshops, briefings and outcome sessions. No expenses are anticipated. Security Clearance Minimum Baseline Personnel Security Standard Additional T&Cs All expenses must be pre-agreed with between the parties and must comply with the Cabinet Office (CO) Travel and Subsistence (T&S) Policy. All vendors are obliged to provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of GDPR and ensures the protection of the rights of data subjects. For further information please see the Information Commissioner's Office website:https://ico.org.uk/for-organisations/data-protection-reform/overview-of-the-gdpr/ Skills & Experience Demonstrable experience of technical migration Demonstrable experience of delivering architectural consistency Demonstrable experience of consolidating features Excellent verbal and non-verbal communication skills - provide an example of both Show in an example at least 5 years experience of Ruby development Show in an example prior knowledge of AWS and SW3 (minimum 2 years experience) Show in an example how your team has strong team-work skills Show in an example previous experience of working with Asset Manager or similar tools Demonstrable experience with large scale file upload management on Linux Systems Show in an example experience with a cloud based storage system. Show in an example at least 5 years experience with Legacy Rails applications Nice to Haves Experience of the GOV.UK Stack or another public sector Stack Experience of providing instruction and documentation to enable learning Demonstrable experience of working in an agile environment Previous experience with GOV.UK stack No. of Suppliers to Evaluate 3 Proposal Criteria Approach and methodology How the approach or solution meets user needs How they’ve identified risks and dependencies and offered approaches to manage them Team structure Value for money How the approach or solution meets your organisation’s policy or goal How to manage Risks and Dependencies associated with Strand 1 and Strand 2 Estimated timeframes to delivery Strand 1 and Strand 2 Cultural Fit Criteria Work as a team with our organisation and other suppliers Transparent and collaborative when making decisions Have a no-blame culture and encourage people to learn from Payment Approach Time and materials Assessment Method Work history Presentation Evaluation Weighting Technical competence 75% Cultural fit 5% Price 20% Questions from Suppliers No questions have been answered yet Budget range £133,000 no more than £750 per resource per day.