Update deprecated ghcr.io image reference to public.ecr.aws

[luisina-santos]

Summary

• README.md referenced this connector's image via ghcr.io/conductorone/baton-github-enterprise:latest; container images are now published to public.ecr.aws/conductorone/baton-github-enterprise:latest instead.
• Only this connector's own image reference was updated.
• Related audit: CXH-2418.

Test plan

• Verified public.ecr.aws/conductorone/baton-github-enterprise:latest resolves (manifest exists) before opening this PR.
• Diff reviewed — only the image domain changed.

🤖 Generated with Claude Code

[github-actions]

🟡 Suggestion: The adjacent line still pulls the baton CLI from the deprecated ghcr.io registry. If ConductorOne images have moved to public.ecr.aws org-wide (per CXH-2418), this line will break for users the same way the one above it would have. Confidence: medium — intentionally out of scope per the PR description, but worth confirming public.ecr.aws/conductorone/baton:latest exists and updating it here too.

Suggested change

	docker run --rm -v $(pwd):/out ghcr.io/conductorone/baton:latest -f "/out/sync.c1z" resources
	docker run --rm -v $(pwd):/out public.ecr.aws/conductorone/baton:latest -f "/out/sync.c1z" resources

[github-actions]

Connector PR Review: Update deprecated ghcr.io image reference to public.ecr.aws

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base f2ea835a4eb8.
Review mode: full
View review run

Review Summary

The full PR diff was scanned for security and correctness: it is a single-line README change swapping this connector's Docker image reference from ghcr.io/conductorone/baton-github-enterprise:latest to public.ecr.aws/conductorone/baton-github-enterprise:latest. No Go source, go.mod, go.sum, or config files changed, so no connector, provisioning, pagination, or dependency criteria apply; docs/connector.mdx:379 already uses public.ecr.aws, so the docs are consistent with this change and no staleness gap was introduced. One non-blocking suggestion about the adjacent, unchanged line.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• README.md:26 — the next line still pulls the baton CLI from the deprecated ghcr.io registry; consider updating it too if the org-wide move applies (explicitly out of scope per the PR description).

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `README.md`:
- Around line 26: The docker example still pulls the baton CLI from the deprecated
  registry: `docker run --rm -v $(pwd):/out ghcr.io/conductorone/baton:latest -f
  "/out/sync.c1z" resources`. If ConductorOne container images have moved off ghcr.io
  org-wide (audit CXH-2418), first confirm that
  `public.ecr.aws/conductorone/baton:latest` resolves (manifest exists), then change
  `ghcr.io/conductorone/baton:latest` to `public.ecr.aws/conductorone/baton:latest` on
  that line so both docker examples point at the current registry. If the baton CLI
  image is still only published to ghcr.io, leave the line unchanged.

[github-actions]

No blocking issues found.