Update deprecated ghcr.io image reference to public.ecr.aws

[luisina-santos]

Summary

• README.md referenced this connector's image via ghcr.io/conductorone/baton-sql-server:latest; container images are now published to public.ecr.aws/conductorone/baton-sql-server:latest instead.
• Only this connector's own image reference was updated.
• Related audit: CXH-2418.

Test plan

• Verified public.ecr.aws/conductorone/baton-sql-server:latest resolves (manifest exists) before opening this PR.
• Diff reviewed — only the image domain changed.

🤖 Generated with Claude Code

[github-actions]

Connector PR Review: Update deprecated ghcr.io image reference to public.ecr.aws

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base cebdf2d20720.
Review mode: full
View review run

Review Summary
The full PR diff was scanned for security and correctness: it is a single-line documentation change in README.md swapping the connector docker image registry from ghcr.io/conductorone/baton-sql-server:latest to public.ecr.aws/conductorone/baton-sql-server:latest. No Go source, go.mod/go.sum, config, or provisioning code changed, so connector behavior, sync output, and the dependency surface are unaffected. No blocking issues found; one scope observation below.

Security Issues
None found.

Correctness Issues
None found.

Suggestions

• README.md:38 — The adjacent command in the same code block still pulls the baton CLI from ghcr.io/conductorone/baton:latest. The PR description says this was intentional (only the connector image itself was in scope), but if that registry is deprecated too, the second copy/paste line in the docker section will break for users. Worth a follow-up once the baton CLI image is confirmed on public.ecr.aws.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

Suggestions:

In `README.md`:
- Around line 38: The docker section still references `ghcr.io/conductorone/baton:latest` for the
  baton CLI, one line below the updated connector image. Confirm whether the baton CLI image is
  published at `public.ecr.aws/conductorone/baton:latest`; if it is, update this line to
  `public.ecr.aws/conductorone/baton:latest` so both commands in the block use the non-deprecated
  registry. If the CLI image is only available on ghcr.io, leave it as is.

[github-actions]

🟡 Suggestion: This second command still pulls the baton CLI from ghcr.io/conductorone/baton:latest, one line below the connector image you just moved to public.ecr.aws. The PR description says that was intentional scope-limiting, so this is non-blocking — but if ghcr.io is being retired, users copy/pasting this block will hit a dead reference. Worth a follow-up once the baton CLI image is confirmed published on public.ecr.aws.

[github-actions]

No blocking issues found.