Publishing happens in CI, triggered by a tag, never from a developer machine
A local publish ships whatever is in the working tree, from a machine holding a long-lived registry token. A tag-triggered CI publish ships a commit that is in the repository and that CI has tested.
Observable check
a release workflow or pipeline triggered by a tag push runs the publish command, and the publish command appears in no local script intended for manual use.