Update deprecated ghcr.io image reference to public.ecr.aws

[luisina-santos]

Summary

• README.md referenced this connector's image via ghcr.io/conductorone/baton-expensify:latest; container images are now published to public.ecr.aws/conductorone/baton-expensify:latest instead.
• Only this connector's own image reference was updated.
• Related audit: CXH-2418.

Test plan

• Verified public.ecr.aws/conductorone/baton-expensify:latest resolves (manifest exists) before opening this PR.
• Diff reviewed — only the image domain changed.

🤖 Generated with Claude Code

[github-actions]

🟡 Suggestion: Pre-existing on this touched line — BATON_PARTNER_USER_SECRET is missing its own -e flag, so docker run parses that token as the image name and the real image reference becomes a command argument. Since this line is already being edited, worth fixing:

Suggested change

	docker run --rm -v $(pwd):/out -e BATON_PARTNER_USER_ID=partnerUserId BATON_PARTNER_USER_SECRET=partnerUserSecret public.ecr.aws/conductorone/baton-expensify:latest -f "/out/sync.c1z"
	docker run --rm -v $(pwd):/out -e BATON_PARTNER_USER_ID=partnerUserId -e BATON_PARTNER_USER_SECRET=partnerUserSecret public.ecr.aws/conductorone/baton-expensify:latest -f "/out/sync.c1z"

[github-actions]

Connector PR Review: Update deprecated ghcr.io image reference to public.ecr.aws

Blocking Issues: 0 | Suggestions: 2 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base ef925ae7028a.
Review mode: full
View review run

Review Summary

The full PR diff was scanned for security and correctness: it is a single-line README change swapping this connector's own image reference from ghcr.io/conductorone/baton-expensify:latest to public.ecr.aws/conductorone/baton-expensify:latest. No Go source, go.mod, go.sum, config, or provisioning files changed, so no connector-behavior, dependency, or breaking-change criteria apply. There was no prior bot feedback on this PR; the two documentation-quality suggestions below are on the same docker block and neither blocks merge.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• README.md:24 — BATON_PARTNER_USER_SECRET=partnerUserSecret is missing its own -e flag, so docker run treats it as the image name and the documented command does not work as written. Pre-existing, but this is the line being edited.
• README.md:25 — The adjacent baton CLI image still points at ghcr.io/conductorone/baton:latest. The PR intentionally scoped the change to this connector's own image, but a user copy-pasting the block will still pull from the deprecated registry on the next line.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `README.md`:
- Around line 24: The docker run example is missing a second -e flag. BATON_PARTNER_USER_SECRET=partnerUserSecret appears without a preceding -e, so docker parses it as the image name and the actual image reference becomes a command argument. Add the missing -e so the line reads: docker run --rm -v $(pwd):/out -e BATON_PARTNER_USER_ID=partnerUserId -e BATON_PARTNER_USER_SECRET=partnerUserSecret public.ecr.aws/conductorone/baton-expensify:latest -f "/out/sync.c1z"
- Around line 25: This line still references the deprecated registry via ghcr.io/conductorone/baton:latest for the baton CLI image, immediately after line 24 was migrated to public.ecr.aws. If the baton CLI image is also published to public.ecr.aws/conductorone/baton, update this line to public.ecr.aws/conductorone/baton:latest so the docker block is internally consistent. If it is not yet published there, leave it as-is.

Note: the machine-readable review-state marker could not be embedded in this comment because the CI sandbox blocked the JSON payload; the next review run will fall back to full mode.

[github-actions]

No blocking issues found.