Release v1.5.18

docs/integrating-scribe/ci-integrations/github/action-bom.md

@@ -173,15 +173,15 @@ To overcome the limitation install tool directly - **[installer](https://github.
 Containerized action can be used on Linux runners as following
 ```yaml
 - name: Generate cyclonedx json SBOM
-  uses: scribe-security/action-bom@v1.5.16
+  uses: scribe-security/action-bom@v1.5.18
   with:
     target: 'busybox:latest'
 ```
 
 Composite Action can be used on Linux or Windows runners as following
 ```yaml
 - name: Generate cyclonedx json SBOM
-  uses: scribe-security/action-bom-cli@v1.5.16
+  uses: scribe-security/action-bom-cli@v1.5.18
   with:
     target: 'hello-world:latest'
 ```
@@ -320,6 +320,47 @@ jobs:
 
 </details>
 
+### Mapping the DOCKER_CONFIG Environment Variable
+
+When using a job's Docker daemon to pull private images, you might need to log in to your private registry before running **valint**. To ensure that the containerized action `action-bom` can access your private image, set `DOCKER_CONFIG` to a directory in your workflow that is accessible for mapping.
+
+Below is an example configuration:
+
+```yaml
+env:
+  DOCKER_CONFIG: ${{ github.workspace }}/.docker
+
+steps:
+  - name: Login to GitHub Container Registry
+    uses: docker/login-action@v2
+    with:
+      registry: ${{ env.REGISTRY_URL }}
+      username: ${{ secrets.REGISTRY_USERNAME }}
+      password: ${{ secrets.REGISTRY_TOKEN }}
+
+  - name: Generate cyclonedx json SBOM
+    uses: scribe-security/action-bom@master
+    with:
+      target: 'scribesecurity/example:latest'
+```
+
+Alternatively, you can use uncontainerized actions directly:
+
+```yaml
+- name: Login to GitHub Container Registry
+  uses: docker/login-action@v2
+  with:
+    registry: ${{ env.REGISTRY_URL }}
+    username: ${{ secrets.REGISTRY_USERNAME }}
+    password: ${{ secrets.REGISTRY_TOKEN }}
+
+- name: Generate cyclonedx json SBOM
+  uses: scribe-security/action-bom-cli@master
+  with:
+    target: 'scribesecurity/example:latest'
+    format: json
+```
+
 
 ### Running action as non root user
 By default, the action runs in its own pid namespace as the root user. You can change the user by setting specific `USERID` and `USERNAME` environment variables.
@@ -464,7 +505,7 @@ Create SBOM for image hosted by a private registry.
 
 ```YAML
 env:
-  DOCKER_CONFIG: $HOME/.docker
+  DOCKER_CONFIG: ${{ github.workspace }}/.docker
 steps:
   - name: Login to GitHub Container Registry
     uses: docker/login-action@v2
@@ -477,7 +518,7 @@ steps:
     uses: scribe-security/action-bom@master
     with:
       target: 'scribesecurity/example:latest'
-      force: true
+
 ```
 </details>
 

docs/integrating-scribe/ci-integrations/github/action-evidence.md

@@ -138,15 +138,15 @@ The `valint evidence` action is a versatile action designed to include various t
 Containerized action can be used on Linux runners as following
 ```yaml
 - name: Include evidence derived from a file
-  uses: scribe-security/action-evidence@v1.5.16
+  uses: scribe-security/action-evidence@v1.5.18
   with:
     target: some_file.json
 ```
 
 Composite Action can be used on Linux or Windows runners as following
 ```yaml
 - name: Include evidence derived from a file
-  uses: scribe-security/action-evidence-cli@v1.5.16
+  uses: scribe-security/action-evidence-cli@v1.5.18
   with:
     target: some_file.json
 ```

docs/integrating-scribe/ci-integrations/github/action-slsa.md

@@ -157,15 +157,15 @@ To overcome the limitation install tool directly - [installer](https://github.co
 Containerized action can be used on Linux runners as following
 ```yaml
 - name: Generate SLSA provenance
-  uses: scribe-security/action-slsa@v1.5.16
+  uses: scribe-security/action-slsa@v1.5.18
   with:
     target: 'busybox:latest'
 ```
 
 Composite Action can be used on Linux or Windows runners as following
 ```yaml
 - name: Generate cyclonedx json SBOM
-  uses: scribe-security/action-slsa-cli@v1.5.16
+  uses: scribe-security/action-slsa-cli@v1.5.18
   with:
     target: 'hello-world:latest'
 ```

docs/integrating-scribe/ci-integrations/github/action-verify.md

@@ -169,15 +169,15 @@ Containerized action can be used on Linux runners as following
 ```yaml
 - name: valint verify
   id: valint_verify
-  uses: scribe-security/action-verify@v1.5.16
+  uses: scribe-security/action-verify@v1.5.18
   with:
       target: 'busybox:latest'
 ```
 
 Composite Action can be used on Linux or Windows runners as following
 ```yaml
 - name: Generate cyclonedx json SBOM
-  uses: scribe-security/action-verify-cli@v1.5.16
+  uses: scribe-security/action-verify-cli@v1.5.18
   with:
     target: 'hello-world:latest'
 ```

docs/integrating-scribe/ci-integrations/gitlabci.md

@@ -112,6 +112,8 @@ custom-ntia-metadata:
       - valint bom busybox
             --context-type gitlab
             --output-directory ./scribe/valint
+            --author-name bom --author-email bob@company.com
+            --supplier-name alice --supplier-url company2.com --supplier-email alice@company2.com --supplier-phone 001
 ```
 </details>
 

docs/platforms/github-integration.md

@@ -79,7 +79,7 @@ env:
   LOG_LEVEL: "INFO"
   VALINT_SCRIBE_ENABLE: true 
   DOCKER_DRIVER: overlay2
-  DOCKER_CONFIG: $HOME/.docker
+  DOCKER_CONFIG: ${{ github.workspace }}/.docker
   DOCKERHUB_USERNAME: scribesecurity
   SCRIBE_PRODUCT_VERSION: "v0.0.2-github"
 

docs/valint/getting-started-valint.md

@@ -11,7 +11,7 @@ Valint is a tool used to manage `evidence` generation (for directories, file art
 
 Valint also enables you to **capture** any 3rd party report, scan or configuration (any file) into evidence. 
 
-> Latest Version `v1.5.16`.
+> Latest Version `v1.5.18`.
 
 ### Installing Valint