Update deprecated ghcr.io image reference to public.ecr.aws

[luisina-santos]

Summary

• README.md referenced this connector's image via ghcr.io/conductorone/baton-retool:latest; container images are now published to public.ecr.aws/conductorone/baton-retool:latest instead.
• Only this connector's own image reference was updated.
• Related audit: CXH-2418.

Test plan

• Verified public.ecr.aws/conductorone/baton-retool:latest resolves (manifest exists) before opening this PR.
• Diff reviewed — only the image domain changed.

🤖 Generated with Claude Code

[github-actions]

🟡 Suggestion: The next line in the same code block still points at ghcr.io/conductorone/baton:latest. That's the baton CLI image rather than this connector's image, so it's outside the stated scope of this PR — but if ghcr.io is deprecated for all ConductorOne images, this reference will break for anyone copy-pasting the docker section. Worth confirming whether public.ecr.aws/conductorone/baton:latest exists and updating it here too.

[github-actions]

Connector PR Review: Update deprecated ghcr.io image reference to public.ecr.aws

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 778d20979768.
Review mode: full
View review run

Review Summary

The full PR diff was scanned for security and correctness: it is a single-line documentation change in README.md that swaps the docker image registry for this connector from ghcr.io/conductorone/baton-retool:latest to public.ecr.aws/conductorone/baton-retool:latest. No Go source, go.mod, go.sum, config, or provisioning code changed, so no connector behavior, dependency, or breaking-change criteria apply. The new reference is consistent with docs/connector.mdx:207, which already uses public.ecr.aws/conductorone/baton-retool:latest.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• README.md:83 — the adjacent baton CLI docker command in the same code block still references ghcr.io/conductorone/baton:latest (outside the stated scope of this PR, but likely stale for the same reason).

Note: the machine-readable review-state marker could not be written by this run because the sandbox command guard rejects it; the next review will run in full mode. Reviewed head SHA 2dc332a against base 778d209.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `README.md`:
- Around line 83: The docker code block still runs the baton CLI image from the deprecated registry host `ghcr.io/conductorone/baton:latest`. This is a different image from the connector image updated on line 82, so confirm first that `public.ecr.aws/conductorone/baton:latest` is published; if it is, change the registry host on line 83 to `public.ecr.aws` so the whole docker section is consistent. If the baton CLI image is intentionally still published only to ghcr.io, leave line 83 unchanged.

[github-actions]

No blocking issues found.