That's right, what gets published is published from a dev's machine (or perhaps CI), which can (and often does!) include files (perhaps build artifacts) which a

That's right, what gets published is published from a dev's machine (or perhaps CI), which can (and often does!) include files (perhaps build artifacts) which aren't committed to source control. Similar to how perhaps a Java package might have the source in source control, but you push a built JAR to your package manager.