CI: Fix last unpinned action versions

[Sidnioulz]

We've enforced mandatory version pinning for actions.

These are the last outliers

Manual testing

Not needed.

Summary by CodeRabbit

• Chores
  • Updated internal CI/CD infrastructure dependencies to enhance build stability and reliability.

[Copilot]

Pull request overview

Pins the remaining unpinned GitHub Action references to immutable commit SHAs, aligning these CI workflows/composite actions with the repo’s mandatory action version pinning policy.

Changes:

• Updates the composite .github/actions/setup-node-and-install action to use pinned SHAs for actions/setup-node and actions/cache restore/save.
• Normalizes the actions/setup-node version comment formatting in generate-sandboxes.yml to match the repo’s # vX.Y.Z convention.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/generate-sandboxes.yml	Keeps setup-node pinned and standardizes the inline version comment format.
.github/actions/setup-node-and-install/action.yml	Replaces tag-based action references (@v4) with pinned commit SHAs for setup-node and cache restore/save.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9266ef63-24e2-4459-8a38-4f1865c26c30

📥 Commits

Reviewing files that changed from the base of the PR and between 4730339 and 7dd35db.

📒 Files selected for processing (2)

• .github/actions/setup-node-and-install/action.yml
• .github/workflows/generate-sandboxes.yml

---

📝 Walkthrough

Walkthrough

This PR pins three reused GitHub actions to specific commit hashes in the composite action setup workflow, replacing floating version references with deterministic commits for setup-node v6.4.0 and cache actions v5.0.5. The generate-sandboxes workflow is updated to reference the pinned setup-node commit.

Changes

Action Version Pinning

Layer / File(s)	Summary
Action version pins to specific commits .github/actions/setup-node-and-install/action.yml, .github/workflows/generate-sandboxes.yml	actions/setup-node, actions/cache/restore, and actions/cache/save are pinned from floating v4 tags to specific commits. setup-node updates to v6.4.0 and cache actions to v5.0.5. generate-sandboxes workflow simultaneously updates to the pinned setup-node commit.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[storybook-app-bot]

Package Benchmarks

^{Commit: 7dd35db, ran on 11 June 2026 at 08:35:02 UTC}

The following packages have significant changes to their size or dependencies:

@storybook/cli

	Before	After	Difference
Dependency count	203	203	0
Self size	947 KB	908 KB	🎉 -39 KB 🎉
Dependency size	88.99 MB	88.99 MB	🚨 +360 B 🚨
Bundle Size Analyzer	Link	Link