you can use the normal way of interpolating to replace ${attachment}

if you want to opt out of the html escaping, you just pass another option argument `{ safe: 'attachment' }` (check that in other part of the code, I give this without checking)