A request has a global guard, a global interceptor and a global ValidationPipe. Which runs first?

The guard runs first. Nest fixes the order: middleware, guards, interceptors (before part), pipes, handler.

"It depends on registration order in main.ts" is wrong. Registration order doesn't change the order between different kinds of enhancers. This is why an unauthorised user who sends an invalid DTO gets 403, not 400: the guard rejects the request before the pipe validates it.