feat: sanity checks for git repository in Redis cache (#41970)

## Description
A potential corruption of repo is a possible when git in memory feature
is active and git repo is cached in redis,
A sanity check has been placed for git operations when repository is
downloaded from Redis. It checks
- Presence of .git folder
- Compares checksum of repo with branch key


Fixes
#https://linear.app/appsmith/issue/APP-15285/git-connection-issue-persists-for-appsmith-treasury-app

## Automation

/ok-to-test tags="@tag.Git"

### 🔍 Cypress test results
<!-- This is an auto-generated comment: Cypress test results  -->
> [!TIP]
> 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
> Workflow run:
<https://github.com/appsmithorg/appsmith/actions/runs/29080326412>
> Commit: 6cbf5a2
> <a
href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29080326412&attempt=1"
target="_blank">Cypress dashboard</a>.
> Tags: `@tag.Git`
> Spec:
> <hr>Fri, 10 Jul 2026 08:54:58 UTC
<!-- end of auto-generated comment: Cypress test results  -->


## Communication
Should the DevRel and Marketing teams inform users about this change?
- [ ] Yes
- [ ] No


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved reliability when loading cached Git data by verifying
repository integrity and branch information before continuing.
* Automatically clears invalid cached data and stops the download if the
repository looks corrupted or incomplete.
* Added checks for missing Git metadata, missing branches, and
mismatched commit data.

* **Tests**
* Added coverage for Git repository sanity checks, including valid
repositories and several invalid repository states.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: sondermanish

app/server/appsmith-git/src/main/resources/git.sh

@@ -90,6 +90,97 @@ upload_branches_to_redis_hash() {
     redis-exec "$redis_url" HSET "$key_value_pair_key" $branches
 }
 
+# Removes cached repository artifact and branch store from Redis.
+invalidate_redis_git_cache() {
+    local redis_key="$1"
+    local redis_url="$2"
+    local key_value_pair_key="$3"
+
+    log_warn "Invalidating corrupted Redis git cache for key: $redis_key"
+    redis-exec "$redis_url" DEL "$redis_key"
+    redis-exec "$redis_url" DEL "$key_value_pair_key"
+}
+
+# Verifies the extracted directory is a usable git repository.
+verify_git_repo_sanity() {
+    local target_folder="$1"
+
+    if [[ ! -d "$target_folder/.git" ]]; then
+        log_warn "Git sanity check failed: missing .git directory in $target_folder"
+        return 1
+    fi
+
+    if [[ ! -f "$target_folder/.git/HEAD" ]]; then
+        log_warn "Git sanity check failed: missing HEAD in $target_folder/.git"
+        return 1
+    fi
+
+    if [[ "$(git -C "$target_folder" rev-parse --is-inside-work-tree 2>/dev/null || echo false)" != "true" ]]; then
+        log_warn "Git sanity check failed: $target_folder is not a git work tree"
+        return 1
+    fi
+
+    if ! git -C "$target_folder" rev-parse --git-dir >/dev/null 2>&1; then
+        log_warn "Git sanity check failed: cannot resolve git dir for $target_folder"
+        return 1
+    fi
+
+    log_info "Git sanity check passed for $target_folder"
+    return 0
+}
+
+# Verifies cached branch tips in Redis match the extracted repository.
+verify_cached_branch_store() {
+    local target_folder="$1"
+    local redis_url="$2"
+    local key_value_pair_key="$3"
+
+    log_info "Verifying cached branch store for key: $key_value_pair_key"
+
+    local raw
+    raw=$(redis-exec "$redis_url" --raw HGETALL "$key_value_pair_key" | sed 's/\"//g')
+
+    if [[ -z "$raw" ]]; then
+        log_warn "Branch store empty or missing for key '$key_value_pair_key'; skipping branch sanity check"
+        return 0
+    fi
+
+    local arr=()
+    while IFS= read -r line; do
+        arr+=( "$line" )
+    done <<< "$raw"
+
+    for ((i=0; i<${#arr[@]}; i+=2)); do
+        local branch="${arr[i]}"
+        local expected_commit="${arr[i+1]}"
+
+        if [[ -z "$branch" || -z "$expected_commit" ]]; then
+            continue
+        fi
+
+        if ! git -C "$target_folder" show-ref --verify --quiet "refs/heads/$branch" 2>/dev/null; then
+            log_warn "Branch store sanity failed: branch '$branch' not found in repository"
+            return 1
+        fi
+
+        if ! git -C "$target_folder" cat-file -e "${expected_commit}^{commit}" 2>/dev/null; then
+            log_warn "Branch store sanity failed: commit '$expected_commit' for branch '$branch' not found"
+            return 1
+        fi
+
+        local actual_commit
+        actual_commit=$(git -C "$target_folder" rev-parse "refs/heads/$branch")
+
+        if [[ "$actual_commit" != "$expected_commit" && "$actual_commit" != "$expected_commit"* ]]; then
+            log_warn "Branch store sanity failed: branch '$branch' at '$actual_commit', expected '$expected_commit'"
+            return 1
+        fi
+    done
+
+    log_info "Branch store sanity check passed for $target_folder"
+    return 0
+}
+
 # Downloads git repo from Redis or clones if not cached
 git_download() {
     local author_email="$1"
@@ -113,8 +204,19 @@ git_download() {
       return 1
     fi
 
+    if ! verify_git_repo_sanity "$target_folder"; then
+        invalidate_redis_git_cache "$redis_key" "$redis_url" "$key_value_pair_key"
+        return 1
+    fi
+
     rm -f "$target_folder/.git/index.lock"
     git -C "$target_folder" reset --hard
+
+    if ! verify_cached_branch_store "$target_folder" "$redis_url" "$key_value_pair_key"; then
+        invalidate_redis_git_cache "$redis_key" "$redis_url" "$key_value_pair_key"
+        return 1
+    fi
+
     git -C "$target_folder" config user.name "$author_name"
     git -C "$target_folder" config user.email "$author_email"
 }

app/server/appsmith-git/src/test/java/com/appsmith/git/service/GitRepoSanityCheckTest.java

@@ -0,0 +1,109 @@
+package com.appsmith.git.service;
+
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.concurrent.TimeUnit;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Unit tests for {@code verify_git_repo_sanity} in {@code git.sh}.
+ */
+public class GitRepoSanityCheckTest {
+
+    private static Path gitShPath;
+
+    @BeforeAll
+    static void locateGitScript() throws Exception {
+        var resource = GitRepoSanityCheckTest.class.getClassLoader().getResource("git.sh");
+        assertThat(resource).as("git.sh on classpath").isNotNull();
+        gitShPath = Paths.get(resource.toURI());
+    }
+
+    @Test
+    @DisplayName("passes for a valid git repository")
+    void passesForValidRepository(@TempDir Path tempDir) throws Exception {
+        Path repo = tempDir.resolve("valid-repo");
+        initRepositoryWithCommit(repo);
+
+        assertThat(runVerifyGitRepoSanity(repo)).isZero();
+    }
+
+    @Test
+    @DisplayName("fails when directory has no .git")
+    void failsForEmptyDirectory(@TempDir Path tempDir) throws Exception {
+        Path repo = tempDir.resolve("empty-dir");
+        Files.createDirectories(repo);
+
+        assertThat(runVerifyGitRepoSanity(repo)).isEqualTo(1);
+    }
+
+    @Test
+    @DisplayName("fails when .git exists but HEAD is missing")
+    void failsWhenHeadIsMissing(@TempDir Path tempDir) throws Exception {
+        Path repo = tempDir.resolve("partial-git");
+        Files.createDirectories(repo.resolve(".git"));
+
+        assertThat(runVerifyGitRepoSanity(repo)).isEqualTo(1);
+    }
+
+    @Test
+    @DisplayName("fails when .git is a file instead of a directory")
+    void failsWhenGitDirIsAFile(@TempDir Path tempDir) throws Exception {
+        Path repo = tempDir.resolve("broken-git");
+        Files.createDirectories(repo);
+        Files.writeString(repo.resolve(".git"), "not-a-directory");
+
+        assertThat(runVerifyGitRepoSanity(repo)).isEqualTo(1);
+    }
+
+    private static void initRepositoryWithCommit(Path repo) throws IOException, InterruptedException {
+        Files.createDirectories(repo);
+        runGit(repo, "init", "-b", "main");
+        runGit(
+                repo,
+                "-c",
+                "user.email=test@appsmith.com",
+                "-c",
+                "user.name=Test User",
+                "commit",
+                "--allow-empty",
+                "-m",
+                "init");
+    }
+
+    private static void runGit(Path repo, String... args) throws IOException, InterruptedException {
+        String[] command = new String[args.length + 3];
+        command[0] = "git";
+        command[1] = "-C";
+        command[2] = repo.toAbsolutePath().toString();
+        System.arraycopy(args, 0, command, 3, args.length);
+
+        Process process = new ProcessBuilder(command).redirectErrorStream(true).start();
+        int exitCode = process.waitFor(30, TimeUnit.SECONDS) ? process.exitValue() : -1;
+        assertThat(exitCode).as("git %s", String.join(" ", args)).isZero();
+    }
+
+    private static int runVerifyGitRepoSanity(Path repo) throws IOException, InterruptedException {
+        String command = String.format(
+                "source '%s' && verify_git_repo_sanity '%s'", gitShPath.toAbsolutePath(), repo.toAbsolutePath());
+
+        Process process = new ProcessBuilder("bash", "-c", command)
+                .redirectErrorStream(true)
+                .start();
+
+        if (!process.waitFor(30, TimeUnit.SECONDS)) {
+            process.destroyForcibly();
+            return -1;
+        }
+
+        return process.exitValue();
+    }
+}