`nx release publish` skips `npm view` pre-check for restricted/private scoped packages, causing 403 on unchanged versions

[nyan-left]

Current Behavior

When running nx release publish in CI (GitLab, OIDC auth), the npm view pre-check that's supposed to skip already-published packages doesn't work for restricted ("access": "restricted") scoped packages. Instead of skipping, nx falls through to pnpm publish which 403s with "You cannot publish over the previously published versions".

This happens because npm view for a restricted package returns a 404 when there's no auth token available for read operations (OIDC tokens only apply during npm publish --provenance, not during npm view). The executor's catch block at release-publish.impl.ts:291 sees the 404 and interprets it as "package doesn't exist yet, first-time publish" -- so it proceeds to publish, which then fails with 403 because the version already exists.

For public packages the pre-check works perfectly -- we see Skipped package "@zappar/mattercraft-transformers" because v0.3.1 already exists in the logs. But for our one restricted package (@zappar/mpm), it always tries to re-publish.

Expected Behavior

nx release publish should gracefully handle restricted packages that are already published. Either:

1. The npm view command should use whatever auth is available (OIDC or otherwise) for read operations too, or
2. A 403 "already published" response from pnpm publish should be treated as a success (the version exists, which is the desired state), or
3. There should be a way to skip specific packages from the publish step without removing them from the release config entirely

GitHub Repo

No response

Steps to Reproduce

1. Set up an nx monorepo with independent versioning and createRelease: "gitlab"
2. Have a mix of public and restricted ("access": "restricted") scoped packages
3. Configure OIDC auth via id_tokens in .gitlab-ci.yml (no NODE_AUTH_TOKEN)
4. Publish all packages at least once
5. Make a change to only ONE package, run nx release --skip-publish then nx release publish
6. The unchanged restricted package will 403 because npm view returns 404 (no auth for reads) and nx tries to re-publish the existing version

The public packages correctly show "Skipped ... because vX.Y.Z already exists" but restricted packages always attempt to publish.

Nx Report

nx 22.5.4
pnpm 10.32.1
node 24

Failure Logs

> nx run @scope/private-package:nx-release-publish
pnpm publish error:
403 Forbidden - PUT https://registry.npmjs.org/@scope%2fprivate-package - You cannot publish over the previously published versions: 1.3.0.


Meanwhile, public packages in the same run correctly skip:


> nx run @scope/public-package:nx-release-publish
Skipped package "@scope/public-package" because v0.3.1 already exists in https://registry.npmjs.org/ with tag "latest"

Package Manager Version

pnpm 10.32.1

Operating System

• macOS
• Linux
• Windows
• Other (Please specify)

Additional Information

We worked around this by changing all packages except the problematic one to "access": "public" and running npm access set status=public on the registry. But that's not viable for packages that genuinely need to stay restricted.