Difficulties using SecurityCodeScan SAST analyzer in multi-project .NET Core solution

Summary

When running the SecurityCodeScan SAST analyzer in my project, I consistently get "exit status 1" results from the analyzer, without any further details.

Steps to reproduce

docker run --interactive --tty --rm --volume "$PWD":/code --volume /var/run/docker.sock:/var/run/docker.sock registry.gitlab.com/gitlab-org/security-products/sast:${VERSION:-latest} /app/bin/run /code

This, from the repository, run in the project folder, causes the issue. I did not try it from GitLab itself, as I wanted to test out the SAST analyzers myself manually first.

Example Project

A sample project with this behaviour: https://gitlab.com/josemaia/gitlabtest/tree/master

What is the current bug behavior?

Exit status 1 from this analyzer, crashing the whole test.

What is the expected correct behavior?

Successful detection of the vulnerable patterns (i.e. hardcoded password in the example)

Relevant logs and/or screenshots

2: Pulling from gitlab-org/security-products/analyzers/security-code-scan
Digest: sha256:ccbd54a6cf0de9370c08d8e336ef14c5e71c7bc8cf2b3c27a1b0b662f733f0a5
Status: Image is up to date for registry.gitlab.com/gitlab-org/security-products/analyzers/security-code-scan:2
Found project in /tmp/app/Dependencies
2019/05/23 12:48:13 exit status 1
2019/05/23 12:48:13 Container exited with non zero status code

Output of checks

Not applicable, as I'm running outside of GitLab itself.

Possible fixes

See this comment. Either we need to wait for that MR referenced in that comment to be merged, or to extract the changes relevant to this problem into a new MR, specifically the changes around finding all the projects in the solution and injecting the scanner for each of those projects.