Build scan shows passing when xray fails

[Info] Deploying build info...
[Info] Build info successfully deployed. Browse it in Artifactory under 
****
Scanning build for vulnerabilities
[Info] Triggered Xray build scan... The scan may take a few minutes.
[Info] Xray scan completed.
{
  "summary": {
    "total_alerts": 0,
    "fail_build": false,
    "message": "Build orca-armory number 0.0.1-dev.121.65a1d0f was scanned by Xray and passed with no Alerts",
    "more_details_url": "***"
  },
  "alerts": [],
  "licenses": [
    {
      "name": "Unknown",
      "full_name": "Unknown license",
      "components": [
        "build://orca-armory:0.0.1-dev.121.65a1d0f"
      ]
    }
  ]
}

However, looking at x-ray it shows that the build has a number of issues. Workflow steps (with most things masked):

 JFROG_ARGS: --url *** --user *** --password ***
docker build ***/$BASE_PROJECT:$BUILD_NUMBER
jfrog rt docker-push ***/$BASE_PROJECT:$BUILD_NUMBER docker-local --build-name=$BASE_PROJECT-armory --build-number=$BUILD_NUMBER $JFROG_ARGS
  jfrog rt build-publish $BASE_PROJECT $BUILD_NUMBER $JFROG_ARGS
  jfrog rt build-scan  $BASE_PROJECT-armory $BUILD_NUMBER $JFROG_ARGS

Start by reproducing the shown workflow, especially the jfrog rt build-publish and jfrog rt build-scan commands, and compare their build names and numbers with the Xray result. Trace the build-scan command's result handling; done means the CLI's reported pass/fail status matches the issues shown by Xray.