WAF (Web application firewall) is meant to protect an already deployed application independently of the underlying application.
SAST (Static Application Security Testing) is meant to scan your code and find known vulnerabilities based on code.
DAST (Dynamic Application Security Testing) is meant to scan your already deployed application and find known vulnerabilities based on a live running instance.
SCA (Software Composition Analysis) is meant to analyze third party dependencies for known vulnerabilities.
Don't mix them up, there is no WAF vs SAST/DAST. WAF is meant to be application independent, you could potentially have a vulnerable application, but because you have a WAF in front of it, you still are protected.
An ideal devops environment would involve all of the tools mentioned, although, a potential debate here could be DAST vs SAST, but this is out of scope of the question.