This is my gitlab-ci.yml:

sast:
  stage: test
  artifacts:
    paths:
      - gl-sast-report.json
.sast-analyzer:
  extends: sast
  allow_failure: false
  script:
    - /analyzer run
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'

Does SAST scan the entire source code (Whole repo) for known vulnerabilities.
Or does it only check the changed files in a merge request?

I do not see a setting to toggle this behavior.
My assumption is that the whole repo is being scanned for vulnerabilities.