You want to write a custom SonarQube rule to detect a company-specific anti-pattern: direct database calls from REST controllers instead of going through the service layer. How do you implement and deploy a custom SonarQube plugin?

// Custom SonarQube rule: Detect direct DB access from controllers
// src/main/java/com/acme/sonar/rules/NoDirectDbInControllerRule.java

@Rule(key = "AcmeArchS001")
public class NoDirectDbInControllerRule extends IssuableSubscriptionVisitor {

  private static final Set<String> CONTROLLER_ANNOTATIONS = Set.of(
    "org.springframework.web.bind.annotation.RestController",
    "org.springframework.web.bind.annotation.Controller"
  );

  private static final Set<String> DB_TYPES = Set.of(
    "JdbcTemplate", "NamedParameterJdbcTemplate", "DataSource",
    "EntityManager", "SessionFactory", "DSLContext"
  );

  @Override
  public List<Tree.Kind> nodesToVisit() {
    return List.of(Tree.Kind.CLASS);
  }

  @Override
  public void visitNode(Tree tree) {
    ClassTree classTree = (ClassTree) tree;

    if (!isController(classTree)) return;

    // Check constructor parameters and fields
    for (Tree member : classTree.members()) {
      if (member.is(Tree.Kind.VARIABLE)) {
        VariableTree field = (VariableTree) member;
        String typeName = field.type().symbolType().name();
        if (DB_TYPES.contains(typeName) || typeName.endsWith("Repository")) {
          reportIssue(field,
            "Controllers must not directly access databases. " +
            "Inject a @Service class instead. See: https://wiki.acme.com/arch/layering");
        }
      }
    }
  }

  private boolean isController(ClassTree classTree) {
    return classTree.modifiers().annotations().stream()
      .anyMatch(a -> CONTROLLER_ANNOTATIONS.contains(
        a.annotationType().symbolType().fullyQualifiedName()));
  }
}

// Rule metadata: src/main/resources/org/sonar/l10n/java/rules/acme/AcmeArchS001.html
// <p>REST controllers should delegate data access to service-layer beans...</p>

// Rule test
// src/test/java/com/acme/sonar/rules/NoDirectDbInControllerRuleTest.java
@Test
void test_rule() {
  JavaCheckVerifier.newVerifier()
    .onFile("src/test/files/NonCompliantController.java")
    .withCheck(new NoDirectDbInControllerRule())
    .verifyIssues();  // Expects // Noncompliant comments in test file
}

// Test fixture: src/test/files/NonCompliantController.java
@RestController
public class OrderController {
  private final OrderRepository orderRepo; // Noncompliant
  private final JdbcTemplate jdbc;         // Noncompliant
  private final OrderService orderService; // Compliant
}

// pom.xml plugin packaging
<plugin>
  <groupId>org.sonarsource.sonar-packaging-maven-plugin</groupId>
  <artifactId>sonar-packaging-maven-plugin</artifactId>
  <version>1.23.0.740</version>
  <extensions>true</extensions>
  <configuration>
    <pluginKey>acme-rules</pluginKey>
    <pluginName>Acme Custom Rules</pluginName>
    <pluginClass>com.acme.sonar.AcmeRulesPlugin</pluginClass>
  </configuration>
</plugin>

# Deploy plugin
mvn clean package
cp target/acme-rules-1.0.jar $SONAR_HOME/extensions/plugins/
systemctl restart sonarqube

# Activate rule in profile
curl -u admin:$TOKEN -X POST \
  "https://sonar.company.com/api/qualityprofiles/activate_rule" \
  -d "key=acme-backend-java&rule=acme-rules:AcmeArchS001&severity=MAJOR"