Rework Checkmarx from on premise to Checkmarx One cloud

[kolatts]

Need similar functionality available. On premise is being deprecated.

Service: Checkmarx

---

Submitted via kolatts.github.io/pncli

[claude]

Claude finished @kolatts's task in 7m 39s —— View job • claude/issue-274-20260729-1237 • Create PR ➔

---

Rework Checkmarx: CxSAST → Checkmarx One

Replaced the on-premise CxSAST integration with Checkmarx One across 16 files. All 389 tests pass.

What changed:

Layer	Before	After
Auth flow	Password grant (resource_owner_client)	Client credentials via iam.checkmarx.net/{tenant}
Config fields	username, password	tenantName, clientId, clientSecret
Env vars	PNCLI_CHECKMARX_USERNAME, _PASSWORD	PNCLI_CHECKMARX_TENANT_NAME, _CLIENT_ID, _CLIENT_SECRET
API base	/cxrestapi/projects	/api/projects
ID type	number	string (UUID)

Files changed: src/types/checkmarx.ts, src/types/config.ts, src/lib/config.ts, src/lib/checkmarxFetch.ts, src/services/checkmarx/client.ts, src/services/checkmarx/commands.ts, src/services/config/commands.ts, src/lib/http.ts (fixture), src/lib/checkmarxFetch.test.ts, src/lib/config.test.ts, plus 5 service test fixtures, skills/pncli/checkmarx.md

• Check for duplicates (none found)
• Explore existing Checkmarx integration
• Assess feasibility (feasible)
• Implement changes
  • src/types/checkmarx.ts — new Checkmarx One types
  • src/types/config.ts — new config fields
  • src/lib/config.ts — new env vars
  • src/lib/checkmarxFetch.ts — client_credentials OAuth2 flow
  • src/services/checkmarx/client.ts — new API paths
  • src/services/checkmarx/commands.ts — string UUIDs, updated descriptions
  • src/services/config/commands.ts — new init prompts, test calls
  • src/lib/http.test.ts + 5 service test fixtures — config shape update
  • src/lib/checkmarxFetch.test.ts — new auth flow tests
  • src/lib/config.test.ts — clientSecret masking tests
  • skills/pncli/checkmarx.md — updated docs
• typecheck ✓, lint ✓, tests ✓ (389/389)
• Committed and pushed