Ship the Renamer image and infrastructure with database access 🟩

The task lane pulls the task domain types, both task repositories and four
Postgres modules into the image, plus SQLAlchemy, SQLModel and a driver.
Terraform gains the DB credentials block and five Postgres env vars; the
deploy job gains the three DB secrets the shared workflow already declares.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/deploy_terraform.yml

@@ -532,6 +532,9 @@ jobs:
       TF_VAR_sharepoint_client_secret: ${{ secrets.SHAREPOINT_CLIENT_SECRET }}
       TF_VAR_sharepoint_tenant_id: ${{ secrets.SHAREPOINT_TENANT_ID }}
       TF_VAR_social_housing_wave_3_sharepoint_id: ${{ secrets.SOCIAL_HOUSING_WAVE_3_SHAREPOINT_ID }}
+      TF_VAR_db_host: ${{ secrets.DEV_DB_HOST }}
+      TF_VAR_db_name: ${{ secrets.DEV_DB_NAME }}
+      TF_VAR_db_port: ${{ secrets.DEV_DB_PORT }}
 
 
   # ============================================================

applications/sharepoint_renamer/handler/Dockerfile

@@ -10,6 +10,19 @@ COPY utilities/ utilities/
 COPY backend/__init__.py backend/__init__.py
 # SharepointSubfolders only — the rest of the PasHub service is not needed here.
 COPY domain/pashub_fetcher/ domain/pashub_fetcher/
+# The app-owned-task lane (@task_handler -> TaskOrchestrator -> Postgres): the
+# task domain types, both task repositories, and the Postgres modules they
+# reach. Copied file by file rather than whole-package to keep the image
+# minimal — tests/test_lambda_packaging.py is what says whether it is complete.
+COPY domain/tasks/ domain/tasks/
+COPY repositories/__init__.py repositories/__init__.py
+COPY repositories/tasks/ repositories/tasks/
+COPY infrastructure/__init__.py infrastructure/__init__.py
+COPY infrastructure/postgres/__init__.py infrastructure/postgres/__init__.py
+COPY infrastructure/postgres/config.py infrastructure/postgres/config.py
+COPY infrastructure/postgres/engine.py infrastructure/postgres/engine.py
+COPY infrastructure/postgres/task_table.py infrastructure/postgres/task_table.py
+COPY infrastructure/postgres/subtask_table.py infrastructure/postgres/subtask_table.py
 COPY orchestration/ orchestration/
 COPY applications/sharepoint_renamer/ applications/sharepoint_renamer/
 CMD ["applications.sharepoint_renamer.handler.handler"]

applications/sharepoint_renamer/handler/requirements.txt

@@ -1,3 +1,10 @@
 msal
 requests
 pydantic-settings==2.6.0
+
+# The app-owned-task lane: the handler creates its own task + sub_task through
+# TaskOrchestrator's Postgres repositories. psycopg2 is the driver
+# PostgresConfig defaults to (tests use a different one).
+sqlalchemy==2.0.36
+sqlmodel
+psycopg2-binary==2.9.10

deployment/terraform/lambda/sharepoint_renamer/main.tf

@@ -1,3 +1,11 @@
+data "aws_secretsmanager_secret_version" "db_credentials" {
+  secret_id = "${var.stage}/assessment_model/db_credentials"
+}
+
+locals {
+  db_credentials = jsondecode(data.aws_secretsmanager_secret_version.db_credentials.secret_string)
+}
+
 module "lambda" {
   source = "../../modules/lambda_with_sqs"
 
@@ -18,5 +26,13 @@ module "lambda" {
     SHAREPOINT_CLIENT_SECRET            = var.sharepoint_client_secret
     SHAREPOINT_TENANT_ID                = var.sharepoint_tenant_id
     SOCIAL_HOUSING_WAVE_3_SHAREPOINT_ID = var.social_housing_wave_3_sharepoint_id
+
+    # The run creates its own task + sub_task so the admin portal can see it.
+    # No VPC needed — the same public path every other task-lane Lambda uses.
+    POSTGRES_USERNAME = local.db_credentials.db_assessment_model_username
+    POSTGRES_PASSWORD = local.db_credentials.db_assessment_model_password
+    POSTGRES_HOST     = var.db_host
+    POSTGRES_DATABASE = var.db_name
+    POSTGRES_PORT     = var.db_port
   }
 }

deployment/terraform/lambda/sharepoint_renamer/variables.tf

@@ -27,7 +27,11 @@ variable "timeout" {
 variable "reserved_concurrent_executions" {
   type        = number
   default     = 1
-  description = "Prevent parallel renames causing race conditions on SharePoint."
+  description = <<-EOT
+    Prevent parallel renames causing race conditions on SharePoint. Since the
+    Renamer joined the app-owned-task lane this also caps its DB connections at
+    one — a second lever hanging off the same number.
+  EOT
 }
 
 variable "batch_size" {
@@ -55,6 +59,21 @@ variable "social_housing_wave_3_sharepoint_id" {
   sensitive = true
 }
 
+variable "db_host" {
+  type      = string
+  sensitive = true
+}
+
+variable "db_name" {
+  type      = string
+  sensitive = true
+}
+
+variable "db_port" {
+  type      = string
+  sensitive = true
+}
+
 locals {
   image_uri = "${var.ecr_repo_url}@${var.image_digest}"
 }