chore(deps): update actions/setup-node action to v6

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	major	v5 → v6
actions/setup-node	action	major	v5.0.0 → v6.1.0

---

Release Notes

actions/setup-node (actions/setup-node)

v6

Compare Source

---

Configuration

📅 Schedule: Branch creation - "on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
examples	Ready	Preview, Comment	Jan 9, 2026 9:38am

[vercel]

Suggested change

	- uses: actions/setup-node@v6
	- uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0

The actions/setup-node action is using a floating version tag (@v6) instead of a pinned commit hash, which is inconsistent with the approach used in ci.yml and introduces non-deterministic workflow behavior.

View Details

Analysis

Inconsistent GitHub Actions version pinning in playwright.yml

What fails: .github/workflows/playwright.yml line 21 uses a floating version tag actions/setup-node@v6 instead of a pinned commit hash, inconsistent with ci.yml which uses actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0

How to reproduce: Examine the workflow files:

• ci.yml: Uses pinned commit hash format for all actions (e.g., actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0)
• playwright.yml: Line 21 uses floating tag actions/setup-node@v6

Result: Floating version tags resolve to the latest matching release at workflow runtime, causing non-deterministic behavior where different workflow runs may execute different patch versions of the action.

Expected: All workflows should use pinned commit hashes per GitHub's official security recommendation that "pinning an action to a full-length commit SHA is currently the only way to use an action as an immutable release." This prevents tag mutation attacks and ensures reproducible CI runs.

Fix applied: Updated line 21 to use the same pinned commit hash as ci.yml: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0