By runningdotnet build --no-incremental /p:ErrorLog=Sarif.json to the build commands, the sarif is generated. This gives insights in the diagnostics Roslyn takes into account. Would be useful to have that as a part of the analysis