From 7af860c3282429d6b40cd798fd00099a306d660e Mon Sep 17 00:00:00 2001
From: sandeep-aot <89100322+sandeep-aot@users.noreply.github.com>
Date: Wed, 8 Apr 2026 08:20:23 -0700
Subject: [PATCH 1/7] CCP-4080-create database for temporal

Adds chnges for:-
1. Temporal db
2.Uses ext helm repo to install temporal server and worker
---
 .github/workflows/pr_close.yaml               | 11 +++
 .github/workflows/pr_open.yaml                | 37 +++++++++
 deployments/helm/action-crunchy/values.yml    |  4 +
 .../soba/templates/temporal/configmap.yaml    | 11 +++
 .../templates/temporal/deployment-worker.yaml | 53 ++++++++++++
 deployments/helm/soba/values-dev.yaml         | 10 +++
 deployments/helm/soba/values-pr.yaml          | 17 ++++
 deployments/helm/soba/values.yaml             | 19 +++++
 deployments/helm/temporal/values.yaml         | 80 +++++++++++++++++++
 9 files changed, 242 insertions(+)
 create mode 100644 deployments/helm/soba/templates/temporal/configmap.yaml
 create mode 100644 deployments/helm/soba/templates/temporal/deployment-worker.yaml
 create mode 100644 deployments/helm/temporal/values.yaml

diff --git a/.github/workflows/pr_close.yaml b/.github/workflows/pr_close.yaml
index a89d504..c5f0121 100644
--- a/.github/workflows/pr_close.yaml
+++ b/.github/workflows/pr_close.yaml
@@ -73,6 +73,17 @@ jobs:
           insecure_skip_tls_verify: true
           namespace: ${{ secrets.OC_NAMESPACE }}
 
+      - name: Delete Temporal PR namespace
+        env:
+          NAMESPACE: ${{ secrets.OC_NAMESPACE }}
+          PR_NUM: ${{ needs.set-vars.outputs.PR_NUM }}
+        run: |
+          TEMPORAL_NS="soba-pr-${PR_NUM}"
+          if oc get deployment temporal-admintools -n "${NAMESPACE}" &>/dev/null; then
+            oc exec deployment/temporal-admintools -n "${NAMESPACE}" -- \
+              temporal operator namespace delete -n "${TEMPORAL_NS}" --yes 2>/dev/null || true
+          fi
+
       - name: Uninstall SOBA and delete orphaned resources
         env:
           RELEASE: ${{ needs.set-vars.outputs.RELEASE }}
diff --git a/.github/workflows/pr_open.yaml b/.github/workflows/pr_open.yaml
index 4fc234a..b3feadb 100644
--- a/.github/workflows/pr_open.yaml
+++ b/.github/workflows/pr_open.yaml
@@ -109,6 +109,36 @@ jobs:
           insecure_skip_tls_verify: true
           namespace: ${{ secrets.OC_NAMESPACE }}
 
+      - name: Deploy Shared Temporal (idempotent)
+        env:
+          NAMESPACE: ${{ secrets.OC_NAMESPACE }}
+          TEMPORAL_CHART_VERSION: ${{ vars.TEMPORAL_CHART_VERSION || '0.74.0' }}
+        run: |
+          helm upgrade --install temporal temporal \
+            --repo https://go.temporal.io/helm-charts \
+            --version "${TEMPORAL_CHART_VERSION}" \
+            --namespace "${NAMESPACE}" \
+            --timeout 900s \
+            -f deployments/helm/temporal/values.yaml
+
+          echo "Waiting for schema jobs..."
+          oc wait --for=condition=complete job -l app.kubernetes.io/instance=temporal \
+            -n "${NAMESPACE}" --timeout=600s || true
+
+          echo "Waiting for Temporal frontend..."
+          oc rollout status deployment/temporal-frontend \
+            -n "${NAMESPACE}" --timeout=300s
+
+      - name: Ensure Temporal PR namespace exists
+        env:
+          NAMESPACE: ${{ secrets.OC_NAMESPACE }}
+          PR_NUM: ${{ needs.set-vars.outputs.PR_NUM }}
+        run: |
+          TEMPORAL_NS="soba-pr-${PR_NUM}"
+          oc exec deployment/temporal-admintools -n "${NAMESPACE}" -- \
+            sh -c "temporal operator namespace describe -n ${TEMPORAL_NS} 2>/dev/null || \
+                   temporal operator namespace create -n ${TEMPORAL_NS} --retention 3d"
+
       - name: Get DB config from Crunchy secret
         id: db
         env:
@@ -133,6 +163,7 @@ jobs:
           TAG: sha-${{ needs.build.outputs.short_sha }}
           DOMAIN: ${{ vars.OC_DOMAIN }}
           DATABASE_URI: ${{ steps.db.outputs.uri }}
+          PR_NUM: ${{ needs.set-vars.outputs.PR_NUM }}
         run: |
           REPO_LC=$(echo "$GITHUB_REPOSITORY" | tr '[:upper:]' '[:lower:]')
           # Escape single quotes for YAML: ' -> ''
@@ -155,6 +186,9 @@ jobs:
             admin:
               password: "${{ secrets.FORMIO_ADMIN_PASSWORD }}"
             jwtSecret: "${{ secrets.FORMIO_JWT_SECRET }}"
+          temporal:
+            address: "temporal-frontend.${NAMESPACE}.svc.cluster.local:7233"
+            namespace: "soba-pr-${PR_NUM}"
           OVERRIDE
 
           helm upgrade --install "${RELEASE}" ./deployments/helm/soba \
@@ -186,6 +220,9 @@ jobs:
           echo "Waiting for mongodb rollout..."
           oc rollout status statefulset/${RELEASE}-mongodb -n "${NAMESPACE}" --timeout=300s
 
+          echo "Waiting for temporal-worker rollout..."
+          oc rollout status deployment/${RELEASE}-temporal-worker -n "${NAMESPACE}" --timeout=300s
+
       - name: Release Comment on PR
         uses: marocchino/sticky-pull-request-comment@v2
         if: success()
diff --git a/deployments/helm/action-crunchy/values.yml b/deployments/helm/action-crunchy/values.yml
index d692777..2db27d3 100644
--- a/deployments/helm/action-crunchy/values.yml
+++ b/deployments/helm/action-crunchy/values.yml
@@ -83,3 +83,7 @@ crunchy:
       databases:
         - '{{ .Values.global.config.dbName }}'
         - 'postgres'
+    - name: 'temporal'
+      databases:
+        - 'temporal'
+        - 'temporal_visibility'
diff --git a/deployments/helm/soba/templates/temporal/configmap.yaml b/deployments/helm/soba/templates/temporal/configmap.yaml
new file mode 100644
index 0000000..975d157
--- /dev/null
+++ b/deployments/helm/soba/templates/temporal/configmap.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "soba.fullname" . }}-temporal
+  labels:
+    {{- include "soba.labels" (dict "root" . "component" "temporal") | nindent 4 }}
+data:
+  TEMPORAL_ALLOWED: {{ .Values.temporal.allowed | default "false" | quote }}
+  TEMPORAL_ADDRESS: {{ .Values.temporal.address | default "" | quote }}
+  TEMPORAL_NAMESPACE: {{ .Values.temporal.namespace | default "default" | quote }}
+  TEMPORAL_TASK_QUEUE: {{ .Values.temporal.taskQueue | default "soba" | quote }}
diff --git a/deployments/helm/soba/templates/temporal/deployment-worker.yaml b/deployments/helm/soba/templates/temporal/deployment-worker.yaml
new file mode 100644
index 0000000..3f06bd2
--- /dev/null
+++ b/deployments/helm/soba/templates/temporal/deployment-worker.yaml
@@ -0,0 +1,53 @@
+{{- $tw := .Values.temporalWorker | default dict }}
+{{- $twEnabled := false }}
+{{- if hasKey $tw "enabled" }}{{ $twEnabled = index $tw "enabled" }}{{ end }}
+{{- if $twEnabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "soba.fullname" . }}-temporal-worker
+  labels:
+    {{- include "soba.labels" (dict "root" . "component" "temporal-worker") | nindent 4 }}
+spec:
+  replicas: {{ .Values.temporalWorker.replicas }}
+  selector:
+    matchLabels:
+      {{- include "soba.selectorLabels" (dict "root" . "component" "temporal-worker") | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        checksum/config-temporal: {{ include (print $.Template.BasePath "/temporal/configmap.yaml") . | sha256sum }}
+        checksum/config-app: {{ include (print $.Template.BasePath "/backend/configmap-app.yaml") . | sha256sum }}
+        checksum/config-formio: {{ include (print $.Template.BasePath "/backend/configmap-formio.yaml") . | sha256sum }}
+        checksum/config-sso: {{ include (print $.Template.BasePath "/backend/configmap-sso.yaml") . | sha256sum }}
+        checksum/config-ratelimit: {{ include (print $.Template.BasePath "/backend/configmap-ratelimit.yaml") . | sha256sum }}
+        checksum/secret-db: {{ include (print $.Template.BasePath "/secrets/db-secret.yaml") . | sha256sum }}
+        checksum/secret-formio: {{ include (print $.Template.BasePath "/secrets/formio-secret.yaml") . | sha256sum }}
+      labels:
+        {{- include "soba.selectorLabels" (dict "root" . "component" "temporal-worker") | nindent 8 }}
+    spec:
+      containers:
+        - name: temporal-worker
+          image: "{{ .Values.backend.image.repository }}:{{ .Values.backend.image.tag }}"
+          imagePullPolicy: {{ .Values.backend.image.pullPolicy }}
+          command:
+            - node
+            - backend/dist/src/temporal/worker.js
+          envFrom:
+            - configMapRef:
+                name: {{ include "soba.fullname" . }}-temporal
+            - configMapRef:
+                name: {{ include "soba.fullname" . }}-backend-app
+            - configMapRef:
+                name: {{ include "soba.fullname" . }}-backend-formio
+            - configMapRef:
+                name: {{ include "soba.fullname" . }}-backend-sso
+            - configMapRef:
+                name: {{ include "soba.fullname" . }}-backend-ratelimit
+            - secretRef:
+                name: {{ include "soba.fullname" . }}-db
+            - secretRef:
+                name: {{ include "soba.fullname" . }}-formio
+          resources:
+            {{- toYaml .Values.temporalWorker.resources | nindent 12 }}
+{{- end }}
diff --git a/deployments/helm/soba/values-dev.yaml b/deployments/helm/soba/values-dev.yaml
index 2dcbedf..6802e5c 100644
--- a/deployments/helm/soba/values-dev.yaml
+++ b/deployments/helm/soba/values-dev.yaml
@@ -51,3 +51,13 @@ outboxWorker:
     limits:
       cpu: 100m
       memory: 256Mi
+
+temporal:
+  allowed: "true"
+  address: ""
+  namespace: "soba-dev"
+  taskQueue: "soba"
+
+temporalWorker:
+  enabled: true
+  replicas: 1
diff --git a/deployments/helm/soba/values-pr.yaml b/deployments/helm/soba/values-pr.yaml
index 9707684..2e87b72 100644
--- a/deployments/helm/soba/values-pr.yaml
+++ b/deployments/helm/soba/values-pr.yaml
@@ -77,3 +77,20 @@ outboxWorker:
     limits:
       cpu: 100m
       memory: 256Mi
+
+temporal:
+  allowed: "true"
+  address: ""
+  namespace: "default"
+  taskQueue: "soba"
+
+temporalWorker:
+  enabled: true
+  replicas: 1
+  resources:
+    requests:
+      cpu: 25m
+      memory: 128Mi
+    limits:
+      cpu: 100m
+      memory: 512Mi
diff --git a/deployments/helm/soba/values.yaml b/deployments/helm/soba/values.yaml
index bcb438a..99b354b 100644
--- a/deployments/helm/soba/values.yaml
+++ b/deployments/helm/soba/values.yaml
@@ -227,3 +227,22 @@ mongodb:
   persistence:
     size: 1Gi
     storageClassName: ""
+
+# -- Temporal (shared server, env vars for backend + worker) ------------------
+temporal:
+  allowed: "false"
+  address: ""
+  namespace: "default"
+  taskQueue: "soba"
+
+# -- Temporal worker (same backend image, runs temporal worker process) ------
+temporalWorker:
+  enabled: false
+  replicas: 1
+  resources:
+    requests:
+      cpu: 25m
+      memory: 128Mi
+    limits:
+      cpu: 100m
+      memory: 512Mi
diff --git a/deployments/helm/temporal/values.yaml b/deployments/helm/temporal/values.yaml
new file mode 100644
index 0000000..9d5fdaf
--- /dev/null
+++ b/deployments/helm/temporal/values.yaml
@@ -0,0 +1,80 @@
+server:
+  image:
+    repository: temporalio/server
+    tag: 1.30.3
+  securityContext:
+    runAsUser: null
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+  config:
+    persistence:
+      default:
+        driver: "sql"
+        sql:
+          driver: "postgres12"
+          host: pg-soba-crunchy-primary
+          port: 5432
+          database: temporal
+          user: temporal
+          existingSecret: pg-soba-crunchy-pguser-temporal
+          maxConns: 20
+          maxIdleConns: 20
+          maxConnLifetime: "1h"
+      visibility:
+        driver: "sql"
+        sql:
+          driver: "postgres12"
+          host: pg-soba-crunchy-primary
+          port: 5432
+          database: temporal_visibility
+          user: temporal
+          existingSecret: pg-soba-crunchy-pguser-temporal
+          maxConns: 20
+          maxIdleConns: 20
+          maxConnLifetime: "1h"
+
+cassandra:
+  enabled: false
+mysql:
+  enabled: false
+elasticsearch:
+  enabled: false
+prometheus:
+  enabled: false
+grafana:
+  enabled: false
+
+schema:
+  createDatabase:
+    enabled: false
+  setup:
+    enabled: true
+    backoffLimit: 100
+  update:
+    enabled: true
+    backoffLimit: 100
+
+web:
+  enabled: true
+  resources:
+    requests:
+      cpu: 15m
+      memory: 48Mi
+    limits:
+      cpu: 100m
+      memory: 128Mi
+
+admintools:
+  enabled: true
+  resources:
+    requests:
+      cpu: 10m
+      memory: 48Mi
+    limits:
+      cpu: 50m
+      memory: 128Mi

From 502e6af22eeb61f4c65de0b20884fa3ffdfcec65 Mon Sep 17 00:00:00 2001
From: sandeep-aot <89100322+sandeep-aot@users.noreply.github.com>
Date: Wed, 8 Apr 2026 08:58:41 -0700
Subject: [PATCH 2/7] CCP-4080-Pipeline fix for temporal

Adds fix for pipeline failure due to temporal
---
 deployments/helm/temporal/values.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/deployments/helm/temporal/values.yaml b/deployments/helm/temporal/values.yaml
index 9d5fdaf..6d4d9d6 100644
--- a/deployments/helm/temporal/values.yaml
+++ b/deployments/helm/temporal/values.yaml
@@ -2,8 +2,7 @@ server:
   image:
     repository: temporalio/server
     tag: 1.30.3
-  securityContext:
-    runAsUser: null
+  securityContext: {}
   resources:
     requests:
       cpu: 50m

From 552b6aedc0051c05cb75e2326ca22448ca59ecbb Mon Sep 17 00:00:00 2001
From: sandeep-aot <89100322+sandeep-aot@users.noreply.github.com>
Date: Wed, 8 Apr 2026 11:13:46 -0700
Subject: [PATCH 3/7] CCP-4080-fix pipeline error

---
 deployments/helm/action-crunchy/values.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/deployments/helm/action-crunchy/values.yml b/deployments/helm/action-crunchy/values.yml
index 2db27d3..37ff1b7 100644
--- a/deployments/helm/action-crunchy/values.yml
+++ b/deployments/helm/action-crunchy/values.yml
@@ -87,3 +87,4 @@ crunchy:
       databases:
         - 'temporal'
         - 'temporal_visibility'
+      options: "SUPERUSER CREATEDB CREATEROLE"

From 4fd41798cae2832a5ca0774648f3e96adebb6d2f Mon Sep 17 00:00:00 2001
From: sandeep-aot <89100322+sandeep-aot@users.noreply.github.com>
Date: Wed, 8 Apr 2026 11:59:13 -0700
Subject: [PATCH 4/7] CCP-4080-Pipeline failure fix

Handles Openshift security context.
---
 deployments/helm/temporal/values.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/deployments/helm/temporal/values.yaml b/deployments/helm/temporal/values.yaml
index 6d4d9d6..27e3722 100644
--- a/deployments/helm/temporal/values.yaml
+++ b/deployments/helm/temporal/values.yaml
@@ -2,7 +2,9 @@ server:
   image:
     repository: temporalio/server
     tag: 1.30.3
-  securityContext: {}
+  securityContext:
+    fsGroup: null
+    runAsUser: null
   resources:
     requests:
       cpu: 50m

From 9849033a63c3970df9d6e310e587416c54fb7a3f Mon Sep 17 00:00:00 2001
From: sandeep-aot <89100322+sandeep-aot@users.noreply.github.com>
Date: Wed, 8 Apr 2026 12:59:26 -0700
Subject: [PATCH 5/7] CCP-4080-Pipeline fix

---
 deployments/helm/temporal/values.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/deployments/helm/temporal/values.yaml b/deployments/helm/temporal/values.yaml
index 27e3722..7e6b586 100644
--- a/deployments/helm/temporal/values.yaml
+++ b/deployments/helm/temporal/values.yaml
@@ -14,6 +14,8 @@ server:
       memory: 512Mi
   config:
     persistence:
+      defaultStore: default
+      visibilityStore: visibility
       default:
         driver: "sql"
         sql:

From 92df6bdca83d159abac12e4f83f9d2ca90603b5a Mon Sep 17 00:00:00 2001
From: sandeep-aot <89100322+sandeep-aot@users.noreply.github.com>
Date: Wed, 8 Apr 2026 16:06:26 -0700
Subject: [PATCH 6/7] CCP-4080-pipeline_fix

---
 deployments/helm/temporal/values.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/deployments/helm/temporal/values.yaml b/deployments/helm/temporal/values.yaml
index 7e6b586..2af94cb 100644
--- a/deployments/helm/temporal/values.yaml
+++ b/deployments/helm/temporal/values.yaml
@@ -2,6 +2,8 @@ server:
   image:
     repository: temporalio/server
     tag: 1.30.3
+  configMapsToMount: "sprig"
+  setConfigFilePath: true
   securityContext:
     fsGroup: null
     runAsUser: null

From 2514dd8547cef3690662f0fb48fdfbb5242ab5af Mon Sep 17 00:00:00 2001
From: sandeep-aot <89100322+sandeep-aot@users.noreply.github.com>
Date: Thu, 9 Apr 2026 14:34:05 -0700
Subject: [PATCH 7/7] CCP-4080-pipeline changes

adds docker file to use lts-slim for temporal worker image as it doesnt work with existing backend alpine image used for soba
---
 .github/workflows/build-images.yaml           | 27 ++++++++++++++++---
 .github/workflows/pr_open.yaml                |  4 +++
 backend/Dockerfile.temporal-worker            | 25 +++++++++++++++++
 .../templates/temporal/deployment-worker.yaml |  7 ++---
 deployments/helm/soba/values-dev.yaml         |  4 +++
 deployments/helm/soba/values-pr.yaml          |  4 +++
 deployments/helm/soba/values.yaml             |  6 ++++-
 7 files changed, 68 insertions(+), 9 deletions(-)
 create mode 100644 backend/Dockerfile.temporal-worker

diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml
index 3817539..eb452c1 100644
--- a/.github/workflows/build-images.yaml
+++ b/.github/workflows/build-images.yaml
@@ -133,13 +133,15 @@ jobs:
           if echo "$PLATFORMS" | grep -q 'amd64'; then
             MATRIX=$(echo "$MATRIX" | jq -c '.include += [
               {"component":"backend","dockerfile_dir":"./backend","platform":"linux/amd64","platform_pair":"linux-amd64","runner":"ubuntu-latest"},
-              {"component":"frontend","dockerfile_dir":"./frontend","platform":"linux/amd64","platform_pair":"linux-amd64","runner":"ubuntu-latest"}
+              {"component":"frontend","dockerfile_dir":"./frontend","platform":"linux/amd64","platform_pair":"linux-amd64","runner":"ubuntu-latest"},
+              {"component":"temporal-worker","dockerfile_dir":"./backend","dockerfile":"Dockerfile.temporal-worker","platform":"linux/amd64","platform_pair":"linux-amd64","runner":"ubuntu-latest"}
             ]')
           fi
           if echo "$PLATFORMS" | grep -q 'arm64'; then
             MATRIX=$(echo "$MATRIX" | jq -c '.include += [
               {"component":"backend","dockerfile_dir":"./backend","platform":"linux/arm64","platform_pair":"linux-arm64","runner":"ubuntu-24.04-arm"},
-              {"component":"frontend","dockerfile_dir":"./frontend","platform":"linux/arm64","platform_pair":"linux-arm64","runner":"ubuntu-24.04-arm"}
+              {"component":"frontend","dockerfile_dir":"./frontend","platform":"linux/arm64","platform_pair":"linux-arm64","runner":"ubuntu-24.04-arm"},
+              {"component":"temporal-worker","dockerfile_dir":"./backend","dockerfile":"Dockerfile.temporal-worker","platform":"linux/arm64","platform_pair":"linux-arm64","runner":"ubuntu-24.04-arm"}
             ]')
           fi
           # Use delimiter so JSON is not mangled by GITHUB_OUTPUT parsing
@@ -194,7 +196,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ${{ matrix.dockerfile_dir }}/Dockerfile
+          file: ${{ matrix.dockerfile_dir }}/${{ matrix.dockerfile || 'Dockerfile' }}
           platforms: ${{ matrix.platform }}
           labels: |
             org.opencontainers.image.revision=${{ github.sha }}
@@ -288,3 +290,22 @@ jobs:
               --annotation "index:org.opencontainers.image.description=SOBA Next.js frontend for web form builder" \
               -t ${IMAGE}:latest ${DIGESTS}
           fi
+
+      - name: Merge temporal-worker
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          IMAGE="ghcr.io/${{ github.repository }}/temporal-worker"
+          IMAGE_VERSION="${{ needs.prepare.outputs.image_version }}"
+          DIGESTS=""
+          for f in $(find digests -type f -name 'temporal-worker-*' 2>/dev/null); do
+            DIGESTS="${DIGESTS} ${IMAGE}@$(cat $f)"
+          done
+          [ -n "$DIGESTS" ] || { echo "No temporal-worker digests"; exit 1; }
+          docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.description=SOBA Temporal worker for workflow execution" \
+            -t ${IMAGE}:sha-${SHORT_SHA} -t ${IMAGE}:${IMAGE_VERSION} ${DIGESTS}
+          if [ "$IMAGE_VERSION" = "main" ]; then
+            docker buildx imagetools create \
+              --annotation "index:org.opencontainers.image.description=SOBA Temporal worker for workflow execution" \
+              -t ${IMAGE}:latest ${DIGESTS}
+          fi
diff --git a/.github/workflows/pr_open.yaml b/.github/workflows/pr_open.yaml
index b3feadb..17d6cb2 100644
--- a/.github/workflows/pr_open.yaml
+++ b/.github/workflows/pr_open.yaml
@@ -178,6 +178,10 @@ jobs:
             image:
               repository: "ghcr.io/${REPO_LC}/frontend"
               tag: "${TAG}"
+          temporalWorker:
+            image:
+              repository: "ghcr.io/${REPO_LC}/temporal-worker"
+              tag: "${TAG}"
           global:
             domain: "${DOMAIN}"
           database:
diff --git a/backend/Dockerfile.temporal-worker b/backend/Dockerfile.temporal-worker
new file mode 100644
index 0000000..93d3242
--- /dev/null
+++ b/backend/Dockerfile.temporal-worker
@@ -0,0 +1,25 @@
+FROM node:lts-slim
+
+# enable pnpm via corepack and ensure workspace installs work
+RUN corepack enable pnpm
+
+WORKDIR /app
+
+# copy root workspace config + backend package file
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
+COPY backend/package.json backend/
+
+# install only backend deps (hoisted into root node_modules)
+RUN pnpm install --filter ./backend...
+
+# copy entire repo and build backend
+COPY . .
+RUN pnpm --filter ./backend run build
+
+# OpenShift / arbitrary UID: run non-root; g=u lets assigned user (often gid 0) read /app
+RUN chgrp -R 0 /app && chmod -R g=u /app
+ENV HOME=/tmp
+ENV XDG_CACHE_HOME=/tmp/.cache
+USER 1001
+
+CMD ["node", "backend/dist/temporal-worker.js"]
diff --git a/deployments/helm/soba/templates/temporal/deployment-worker.yaml b/deployments/helm/soba/templates/temporal/deployment-worker.yaml
index 3f06bd2..9f3bdf4 100644
--- a/deployments/helm/soba/templates/temporal/deployment-worker.yaml
+++ b/deployments/helm/soba/templates/temporal/deployment-worker.yaml
@@ -28,11 +28,8 @@ spec:
     spec:
       containers:
         - name: temporal-worker
-          image: "{{ .Values.backend.image.repository }}:{{ .Values.backend.image.tag }}"
-          imagePullPolicy: {{ .Values.backend.image.pullPolicy }}
-          command:
-            - node
-            - backend/dist/src/temporal/worker.js
+          image: "{{ .Values.temporalWorker.image.repository }}:{{ .Values.temporalWorker.image.tag }}"
+          imagePullPolicy: {{ .Values.temporalWorker.image.pullPolicy }}
           envFrom:
             - configMapRef:
                 name: {{ include "soba.fullname" . }}-temporal
diff --git a/deployments/helm/soba/values-dev.yaml b/deployments/helm/soba/values-dev.yaml
index 6802e5c..04490ad 100644
--- a/deployments/helm/soba/values-dev.yaml
+++ b/deployments/helm/soba/values-dev.yaml
@@ -60,4 +60,8 @@ temporal:
 
 temporalWorker:
   enabled: true
+  image:
+    repository: ghcr.io/bcgov/soba/temporal-worker
+    tag: latest
+    pullPolicy: IfNotPresent
   replicas: 1
diff --git a/deployments/helm/soba/values-pr.yaml b/deployments/helm/soba/values-pr.yaml
index 2e87b72..063c099 100644
--- a/deployments/helm/soba/values-pr.yaml
+++ b/deployments/helm/soba/values-pr.yaml
@@ -86,6 +86,10 @@ temporal:
 
 temporalWorker:
   enabled: true
+  image:
+    repository: ghcr.io/bcgov/soba/temporal-worker
+    tag: latest
+    pullPolicy: IfNotPresent
   replicas: 1
   resources:
     requests:
diff --git a/deployments/helm/soba/values.yaml b/deployments/helm/soba/values.yaml
index 99b354b..a6a7202 100644
--- a/deployments/helm/soba/values.yaml
+++ b/deployments/helm/soba/values.yaml
@@ -235,9 +235,13 @@ temporal:
   namespace: "default"
   taskQueue: "soba"
 
-# -- Temporal worker (same backend image, runs temporal worker process) ------
+# -- Temporal worker (dedicated image with glibc for @temporalio/core-bridge) --
 temporalWorker:
   enabled: false
+  image:
+    repository: ghcr.io/bcgov/soba/temporal-worker
+    tag: latest
+    pullPolicy: IfNotPresent
   replicas: 1
   resources:
     requests: