Harden filter evaluation and command execution #14591

Namespace: <a href="https://konflux-ui.apps.kflux-prd-rh02.0fk9.p1.openshiftapps.com/ns/ocp-isc-tenant" rel="nofollow">ocp-isc-tenant
PipelineRun: <a href="https://konflux-ui.apps.kflux-prd-rh02.0fk9.p1.openshiftapps.com/ns/ocp-isc-tenant/pipelinerun/compliance-operator-content-dev-on-pull-request-qg82j" rel="nofollow">compliance-operator-content-dev-on-pull-request-qg82j

Success

Konflux kflux-prd-rh02/compliance-operator-content-dev-on-pull-request has successfully validated your commit.

Status	Duration	Name
🟢 Succeeded	5 seconds	init
🟢 Succeeded	13 seconds	clone-repository
🟢 Succeeded	1 minute	prefetch-dependencies
🟢 Succeeded	3 minutes	build-images
🟢 Succeeded	4 minutes	build-images
🟢 Succeeded	1 minute	build-images
🟢 Succeeded	2 minutes	build-images
🟢 Succeeded	21 seconds	build-image-index
🟢 Succeeded	7 seconds	apply-tags
🟢 Succeeded	50 seconds	build-source-image
🟢 Succeeded	25 seconds	clair-scan
🟢 Succeeded	25 seconds	clair-scan
🟢 Succeeded	25 seconds	clair-scan
🟢 Succeeded	25 seconds	clair-scan
🟢 Succeeded	23 seconds	clamav-scan
🟢 Succeeded	25 seconds	clamav-scan
🟢 Succeeded	23 seconds	clamav-scan
🟢 Succeeded	23 seconds	clamav-scan
🟢 Succeeded	25 seconds	coverity-availability-check
🟢 Succeeded	47 seconds	deprecated-base-image-check
🟢 Succeeded	42 seconds	ecosystem-cert-preflight-checks
🟢 Succeeded	42 seconds	ecosystem-cert-preflight-checks
🟢 Succeeded	42 seconds	ecosystem-cert-preflight-checks
🟢 Succeeded	43 seconds	ecosystem-cert-preflight-checks
🟢 Succeeded	10 seconds	push-dockerfile
🟢 Succeeded	24 seconds	rpms-signature-scan
🟢 Succeeded	30 seconds	sast-shell-check
🟢 Succeeded	36 seconds	sast-snyk-check
🟢 Succeeded	32 seconds	sast-unicode-check
🟢 Succeeded	14 minutes	sast-coverity-check
🟢 Succeeded	7 seconds	show-sbom