We've confirmed that the publish needs to be done sequentially: core, auth, then app. Currently it's setup to be done in parallel.
We should also add some extra protection to prevent publishes being done during the development process. See the safe-nd repo.