chore: download tarbal

Author: collins-w

.github/workflows/publish.yml

@@ -263,6 +263,13 @@ jobs:
           name: ${{ github.ref_name }}
           path: ${{ needs.provenance.outputs.package-name }}
 
+      - name: Download tarball
+        uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@3bcecb4ade4f265cff30488059a9dca39e26b360 # main
+        with:
+          name: ${{ needs.provenance.outputs.package-download-name }}
+          path: ${{ needs.provenance.outputs.package-name }}
+          sha256: ${{ needs.provenance.outputs.package-download-sha256 }}
+
       - name: Publish main
         run: |
             echo "//registry.npmjs.org/:_authToken=\${NPM_TOKEN}" > .npmrc