Workaround for GH Actions stripping permissions

Closes #1665

ci/steps/publish-npm.sh

@@ -9,9 +9,9 @@ main() {
     echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
   fi
 
-  download_artifact npm-package ./release
+  download_artifact npm-package ./release-npm-package
   # https://github.com/actions/upload-artifact/issues/38
-  chmod +x $(grep -rl '^#!/.*' release)
+  tar -xzf release-npm-package/package.tar.gz
   yarn publish --non-interactive release
 }