See my ask for details in Gemnasium-maven-dependency_scanning fails because of a probable bug in GitLab - #2 by dnsmichi – I think there is confusion about SAST / Dependency scanning, and we will need the full CI/CD configuration - best in a public GitLab.com project to inspect and reproduce.