Update deprecated ghcr.io image reference to public.ecr.aws

[luisina-santos]

Summary

• README.md referenced this connector's image via ghcr.io/conductorone/baton-duo:latest; container images are now published to public.ecr.aws/conductorone/baton-duo:latest instead.
• Only this connector's own image reference was updated.
• Related audit: CXH-2418.

Test plan

• Verified public.ecr.aws/conductorone/baton-duo:latest resolves (manifest exists) before opening this PR.
• Diff reviewed — only the image domain changed.

🤖 Generated with Claude Code

[github-actions]

🟡 Suggestion: This documented command doesn't work as written (pre-existing, but on the line you touched). Only BATON_SECRET_KEY has an -e; Docker treats the next positional arg, BATON_INTEGRATION_KEY=integrationKey, as the image name, so the run fails before reaching public.ecr.aws/.... Each variable needs its own -e.

Suggested change

	docker run --rm -v $(pwd):/out -e BATON_SECRET_KEY=secretKey BATON_INTEGRATION_KEY=integrationKey BATON_API_HOSTNAME=apiHostname public.ecr.aws/conductorone/baton-duo:latest -f "/out/sync.c1z"
	docker run --rm -v $(pwd):/out -e BATON_SECRET_KEY=secretKey -e BATON_INTEGRATION_KEY=integrationKey -e BATON_API_HOSTNAME=apiHostname public.ecr.aws/conductorone/baton-duo:latest -f "/out/sync.c1z"

[github-actions]

🟡 Suggestion (low confidence): The next line still uses ghcr.io/conductorone/baton:latest. The PR description intentionally scopes this to the connector's own image, and that's the baton CLI from a different repo — but if the ghcr.io deprecation is org-wide, this reference is stale too and sits two lines from the one you fixed. Worth confirming whether the baton CLI image is also published to public.ecr.aws/conductorone/baton.

[github-actions]

Connector PR Review: Update deprecated ghcr.io image reference to public.ecr.aws

Blocking Issues: 0 | Suggestions: 2 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 3b09bea23de7.
Review mode: full
View review run

Review Summary

Scanned the full PR diff for security and correctness: it is a single-line documentation change swapping this connector's docker image registry from ghcr.io/conductorone/baton-duo:latest to public.ecr.aws/conductorone/baton-duo:latest. No Go source, go.mod, go.sum, or config files changed, so no connector, provisioning, pagination, or dependency criteria apply. The new reference matches docs/connector.mdx:205, which already used public.ecr.aws/conductorone/baton-duo:latest, so this resolves an existing README/docs inconsistency; two non-blocking README suggestions are noted below.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• README.md:30 — the documented docker command is missing -e before BATON_INTEGRATION_KEY and BATON_API_HOSTNAME, so Docker parses BATON_INTEGRATION_KEY=integrationKey as the image name and the command fails (pre-existing, but on the modified line).
• README.md:31 — ghcr.io/conductorone/baton:latest still points at the deprecated registry; out of this PR's stated scope since it's the baton CLI from another repo, but worth confirming (low confidence).

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `README.md`:
- Around line 30: The docker run example only passes `-e` for `BATON_SECRET_KEY`; `BATON_INTEGRATION_KEY=integrationKey` and `BATON_API_HOSTNAME=apiHostname` are bare positional arguments, so Docker interprets the first of them as the image name and the command fails before reaching `public.ecr.aws/conductorone/baton-duo:latest`. Add an explicit `-e` before each environment variable: `docker run --rm -v $(pwd):/out -e BATON_SECRET_KEY=secretKey -e BATON_INTEGRATION_KEY=integrationKey -e BATON_API_HOSTNAME=apiHostname public.ecr.aws/conductorone/baton-duo:latest -f "/out/sync.c1z"`.
- Around line 31: This line still references `ghcr.io/conductorone/baton:latest` for the `baton` CLI image while line 30 was migrated to `public.ecr.aws`. Confirm whether the `baton` CLI image is also published to `public.ecr.aws/conductorone/baton`; if it is, update this line for consistency. If the CLI is still only on ghcr.io, leave it as-is.

[github-actions]

No blocking issues found.