Update deprecated ghcr.io image reference to public.ecr.aws

[luisina-santos]

Summary

• README.md referenced this connector's image via ghcr.io/conductorone/baton-scim:latest; container images are now published to public.ecr.aws/conductorone/baton-scim:latest instead.
• Only this connector's own image reference was updated.
• Related audit: CXH-2418.

Test plan

• Verified public.ecr.aws/conductorone/baton-scim:latest resolves (manifest exists) before opening this PR.
• Diff reviewed — only the image domain changed.

🤖 Generated with Claude Code

[github-actions]

🟡 Suggestion: This docker run invocation is malformed (pre-existing, but on the line you touched). Docker will parse BATON_SERVICE_PROVIDER=slack as the image name, since the second env var is missing its own -e flag and the stray baton-scim sits before the image reference. Since you're already correcting this line, consider making it copy-pasteable:

Suggested change

	docker run --rm -v $(pwd):/out -e BATON_TOKEN=oauth2Token BATON_SERVICE_PROVIDER=slack baton-scim public.ecr.aws/conductorone/baton-scim:latest -f "/out/sync.c1z"
	docker run --rm -v $(pwd):/out -e BATON_TOKEN=oauth2Token -e BATON_SERVICE_PROVIDER=slack public.ecr.aws/conductorone/baton-scim:latest -f "/out/sync.c1z"

[github-actions]

🟡 Suggestion: The baton CLI image on the next line still points at ghcr.io/conductorone/baton:latest. The PR description says only this connector's own image was intentionally in scope, so this may be deliberate — but if CXH-2418 covers all ConductorOne images, users copy-pasting this block will still hit the deprecated registry for the second command.

[github-actions]

Connector PR Review: Update deprecated ghcr.io image reference to public.ecr.aws

Blocking Issues: 0 | Suggestions: 2 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 23abf2fff8ac.
Review mode: full
View review run

Review Summary

This PR changes a single README line, swapping the connector's Docker image reference from ghcr.io/conductorone/baton-scim:latest to public.ecr.aws/conductorone/baton-scim:latest. The full PR diff was scanned for security and correctness: no Go source, go.mod/go.sum, config, or provisioning code changed, so no connector implementation, dependency, or breaking-change criteria apply. No blocking issues found; two documentation-quality suggestions are noted on the touched Docker block.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• README.md:132 — The docker run command is malformed: the second env var is missing its own -e flag and a stray baton-scim argument precedes the image reference, so Docker would parse BATON_SERVICE_PROVIDER=slack as the image name. Pre-existing, but on the line being edited.
• README.md:133 — The adjacent baton CLI image still references ghcr.io/conductorone/baton:latest. The PR description scopes this out intentionally; flagged only in case CXH-2418 covers all ConductorOne images.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `README.md`:
- Around line 132: The `docker run` example is not copy-pasteable. It reads
  `docker run --rm -v $(pwd):/out -e BATON_TOKEN=oauth2Token BATON_SERVICE_PROVIDER=slack baton-scim public.ecr.aws/conductorone/baton-scim:latest -f "/out/sync.c1z"`.
  Two problems: the second environment variable `BATON_SERVICE_PROVIDER=slack` is missing
  its own `-e` flag, and the bare token `baton-scim` appears before the image reference.
  Docker parses the first non-flag argument as the image name, so it would treat
  `BATON_SERVICE_PROVIDER=slack` as the image. Fix by adding `-e` before the second env var
  and deleting the stray `baton-scim` token, yielding:
  `docker run --rm -v $(pwd):/out -e BATON_TOKEN=oauth2Token -e BATON_SERVICE_PROVIDER=slack public.ecr.aws/conductorone/baton-scim:latest -f "/out/sync.c1z"`
- Around line 133: The second docker command still pulls the `baton` CLI from the deprecated
  registry: `ghcr.io/conductorone/baton:latest`. The PR description states only this
  connector's own image was intentionally in scope, so this may be a deliberate omission.
  If the CXH-2418 migration covers all ConductorOne images, update this to
  `public.ecr.aws/conductorone/baton:latest` so the whole code block works after the ghcr.io
  deprecation. Confirm that image tag actually resolves on public.ecr.aws before changing it.

[github-actions]

No blocking issues found.