github.com/FreeRADIUS/freeradius-server (link)

name: Claude Code Review

#
#  The workflow uses `pull_request_target` rather than `pull_request`.  GitHub
#  never grants the `id-token` permission to a fork's `pull_request` run, so the
#  Anthropic authentication failed on every pull request from a fork.  The
#  target event runs in the base repository's context with real permissions.
#  The checkout below stays on the base branch, and the review reads the
#  pull request through the GitHub application programming interface (API).
#  No code from the for

name: Claude Code

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  issues:
    types: [opened, assigned]
  pull_request_review:
    types: [submitted]

jobs:
  claude:
    #
    #  The condition restricts the job to trusted contributors. The
    #  Claude Code action needs `id-token: write`. GitHub denies
    #  `id-token: write` for events originating on fork pull requests,
    #  regardless of what we put in the `permissions:` block. Without the
    #  condi

# Policy on AI Agents

> [!IMPORTANT]
> This project does **not** accept pull requests that are fully or
> predominantly AI-generated. AI tools may be utilized solely to
> assist individual development.
>
> If we receive an AI PR that _clearly has had zero testing_, then we
> will **ban the person who submitted the PR**.
>
> Submitting a garbage PR isn't just AI slop, it's abuse.

AI assistance is fine.  But when someone submits a PR, we assume that
they understand the submission, and that they accept full