Update deprecated ghcr.io image reference to public.ecr.aws

[luisina-santos]

Summary

• README.md referenced this connector's image via ghcr.io/conductorone/baton-databricks:latest; container images are now published to public.ecr.aws/conductorone/baton-databricks:latest instead.
• Only this connector's own image reference was updated.
• Related audit: CXH-2418.

Test plan

• Verified public.ecr.aws/conductorone/baton-databricks:latest resolves (manifest exists) before opening this PR.
• Diff reviewed — only the image domain changed.

🤖 Generated with Claude Code

[github-actions]

🟡 Suggestion: Pre-existing on this line, but since you're touching it — only BATON_ACCOUNT_ID has an -e flag. Docker will parse BATON_DATABRICKS_CLIENT_ID=client_id as the image name, so this command fails as written. Each variable needs its own -e.

Suggested change

	docker run --rm -v $(pwd):/out -e BATON_ACCOUNT_ID=account_id BATON_DATABRICKS_CLIENT_ID=client_id BATON_DATABRICKS_CLIENT_SECRET=client_secret public.ecr.aws/conductorone/baton-databricks:latest -f "/out/sync.c1z"
	docker run --rm -v $(pwd):/out -e BATON_ACCOUNT_ID=account_id -e BATON_DATABRICKS_CLIENT_ID=client_id -e BATON_DATABRICKS_CLIENT_SECRET=client_secret public.ecr.aws/conductorone/baton-databricks:latest -f "/out/sync.c1z"

[github-actions]

Connector PR Review: Update deprecated ghcr.io image reference to public.ecr.aws

Blocking Issues: 0 | Suggestions: 2 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base bfec8a9f5495.
Review mode: full
View review run

Review Summary

The full PR diff was scanned for security and correctness: it is a single-line README documentation change swapping the connector's own image from ghcr.io/conductorone/baton-databricks:latest to public.ecr.aws/conductorone/baton-databricks:latest. No Go source, go.mod/go.sum, config, or provisioning code changed, so no connector, pagination, or dependency criteria apply. The new registry path matches what docs/connector.mdx:273 already documents, so this resolves an existing inconsistency; two non-blocking documentation nits remain in the same code block.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• README.md:63 — only BATON_ACCOUNT_ID carries an -e flag; the other two env vars lack theirs, so Docker parses BATON_DATABRICKS_CLIENT_ID=client_id as the image name and the documented command fails as written (pre-existing, but on the line being touched).
• README.md:64 — the adjacent baton CLI image still points at ghcr.io/conductorone/baton:latest, leaving the same block split across two registries. Intentionally out of scope per the PR description, but worth a follow-up if that image moved too.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `README.md`:
- Around line 63: The documented docker run command only passes `-e` before
  `BATON_ACCOUNT_ID=account_id`. Docker therefore treats
  `BATON_DATABRICKS_CLIENT_ID=client_id` as the image name and the command fails.
  Add an explicit `-e` before each of `BATON_DATABRICKS_CLIENT_ID=client_id` and
  `BATON_DATABRICKS_CLIENT_SECRET=client_secret`.
- Around line 64: This line still references `ghcr.io/conductorone/baton:latest` for
  the baton CLI image while line 63 now uses `public.ecr.aws`. If the baton CLI image
  has also migrated to `public.ecr.aws/conductorone/baton:latest`, update it so the
  code block uses one registry consistently. Leave it unchanged if the CLI image is
  still published only to ghcr.io.

[github-actions]

No blocking issues found.