[Repo Assist] ci: pin KyleMayes/install-llvm-action to v2.0.5 across all workflows

[github-actions]

🤖 This PR was created by Repo Assist, an automated AI assistant.

Summary

Three CI workflows used the floating @v2 tag for KyleMayes/install-llvm-action, while ci.yml already pinned to the exact @v2.0.5 release. This change standardises all four workflows to the pinned version.

Motivation

Floating major-version tags can move when the upstream action author pushes a new patch or breaking release. If @v2 moves to @v2.1.0 with any incompatibility, it could break nightly and install-check workflows unexpectedly. Pinning to @v2.0.5 ensures reproducible, auditable builds — matching the convention already in place in ci.yml.

Affected Workflows

• .github/workflows/nightly-tests.yml — @v2 → @v2.0.5
• .github/workflows/ci-install.yml — @v2 → @v2.0.5
• .github/workflows/advanced-on-demand.yml — @v2 → @v2.0.5

Test Status

CI configuration change only; no source code modified. All workflows will function identically — they will simply be locked to the same patch version that ci.yml already uses successfully.

---

Warning

🛡️ Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files: .github/workflows/advanced-on-demand.yml, .github/workflows/ci-install.yml, .github/workflows/nightly-tests.yml.

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission. A human must create the pull request manually.

To create a pull request with the changes:

# Download the patch from the workflow run
gh run download 23714319739 -n agent-artifacts -D /tmp/agent-artifacts-23714319739

# Create a new branch
git checkout -b repo-assist/eng-pin-llvm-action-v2.0.5-2026-03-29-540601a9e60fbcf6 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-artifacts-23714319739/aw-repo-assist-eng-pin-llvm-action-v2.0.5-2026-03-29.patch

# Push the branch and create the pull request
git push origin repo-assist/eng-pin-llvm-action-v2.0.5-2026-03-29-540601a9e60fbcf6
gh pr create --title '[Repo Assist] ci: pin KyleMayes/install-llvm-action to v2.0.5 across all workflows' --base main --head repo-assist/eng-pin-llvm-action-v2.0.5-2026-03-29-540601a9e60fbcf6 --repo py-why/dowhy

Note

🔒 Integrity filtering filtered 30 items

Integrity filtering activated and filtered the following items during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

• #1418 (list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #1399 (list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #1396 (list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #1392 (list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #1391 (list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #1371 (list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:ImportError: weighting_sampler is not an existing do sampler. #71 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:DoSampler: Fails when you Add a Graph to the Causal Model #83 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Errors of Notebook: The Causal Story Behind Hotel Booking Cancellations #198 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Mediation Analysis key error #214 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:arrays used as indices must be of integer (or boolean) type #225 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:effect_estimate different using do operator and _estimate_effect function #309 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:AttributeError: 'CausalEstimate' object has no attribute '_estimator_object' #357 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:CausalModel.estimate_effect - UnboundLocalError: local variable 'identifier_name' referenced before assignment #365 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Error in Conditional Effect Estimation in backdoor.linear_regression_estimator #401 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:'fit_estimator' argument in 'estimate_effect' function of 'CausalModel' object #414 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• ... and 14 more items

Generated by Repo Assist · ◷

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@b897c2f3e43bde9ff7923c8fa9211055b26e27cc

[JiwaniZakir]

The drift likely originated when ci.yml was manually pinned at some point but the other three workflows were not updated in the same commit, leaving them on the floating @v2 tag. The push failure is expected behavior: GitHub's default GITHUB_TOKEN does not include the workflows write scope, so any automated process (Actions bot, app token without explicit workflows permission) will be rejected when touching files under .github/workflows/. A personal access token with workflow scope, or a GitHub App installation token granted that permission, is required to apply the patch manually via the git am steps provided.