SAST: Variable SAST_EXCLUDED_PATHS is not respected

Summary

While setting up SAST for Gitaly, I noticed that the directories and files specified in SAST_EXCLUDED_PATHS are not excluded from the results.

Steps to reproduce

1. Create a new branch on Gitaly and edit .gitlab-ci.yml with below snippet to enable SAST:

include:
  - template: SAST.gitlab-ci.yml

variables:
  SAST_DISABLE_DIND: "true"
  SAST_EXCLUDED_PATHS: "config.toml.example"
  SAST_DEFAULT_ANALYZERS: "gosec, secrets"

gosec-sast:
  before_script:
    - apk add pkgconfig libgit2-dev gcc libc-dev

2. Push your branch to run the SAST job.
3. Open an MR and inspect the results reported by the SAST job. Note that there are results for the excluded file config.toml.example.

What is the current bug behavior?

The MR widget does include findings for folders and files listed in SAST_EXCLUDED_PATHS.

What is the expected correct behavior?

The MR widget and Security Dashboard do NOT include findings for folders and files listed in SAST_EXCLUDED_PATHS.

Output of checks

This bug happens on GitLab.com

Results of GitLab environment info

Expand for output related to GitLab environment info

(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:env:info)
(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production)

Results of GitLab application Check

Expand for output related to the GitLab application check

(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)
(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)
(we will only investigate if the tests are passing)