Add Bazel build with BoringSSL support

.github/workflows/bazel.yml

@@ -0,0 +1,43 @@
+name: Bazel
+
+on:
+  schedule:
+    - cron: '0 0 * * 1'
+  push:
+    branches: [ '*' ]
+  pull_request:
+    branches: [ master ]
+
+  release:
+    types:
+      - published
+      - prereleased
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-latest]
+        tls: [boringssl, openssl, 'no']
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 100
+          fetch-tags: true
+
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.15.0
+        with:
+          bazelisk-cache: true
+          disk-cache: true
+          repository-cache: true
+
+      - name: Build project
+        run: bazel build //... --@clickhouse_cpp//:tls=${{ matrix.tls }}

.gitignore

@@ -281,3 +281,6 @@ BUCKAROO_DEPS
 
 # clangd cache
 /.cache/clangd
+
+# Bazel
+/bazel-*

BUILD.bazel

@@ -0,0 +1,106 @@
+load("@bazel_skylib//rules:common_settings.bzl", "string_flag")
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+
+# Bazel build for clickhouse-cpp. The canonical build is CMake
+# (top-level CMakeLists.txt); this file mirrors the same library as
+# a bzlmod target so downstream Bazel projects can depend on it via
+# the Bazel Central Registry without standing up CMake.
+#
+# Differences from the CMake build that callers should be aware of:
+#   * TLS links against BoringSSL (`@boringssl`) by default; pass
+#     `--@clickhouse_cpp//:tls=openssl` to use the BCR OpenSSL module
+#     instead, or `--@clickhouse_cpp//:tls=no` to disable TLS
+#     entirely. `USE_BORINGSSL` ifdef-guards the two OpenSSL-only
+#     surfaces (`SSL_CONF_*` command API and `SSL_read_ex`) that
+#     BoringSSL doesn't provide; see clickhouse/base/sslsocket.cpp.
+#   * cityhash / lz4 / zstd / abseil come from BCR modules instead of
+#     contrib/; the contrib/ trees are only used by the CMake build.
+
+# Selects the TLS implementation: `--@clickhouse_cpp//:tls=boringssl`
+# (default), `--@clickhouse_cpp//:tls=openssl`, or
+# `--@clickhouse_cpp//:tls=no` to disable TLS entirely (matching
+# CMake's `WITH_OPENSSL=OFF` default). The two TLS libraries come from
+# BCR modules and are linked statically, keeping the build hermetic.
+string_flag(
+    name = "tls",
+    build_setting_default = "boringssl",
+    values = [
+        "boringssl",
+        "openssl",
+        "no",
+    ],
+)
+
+config_setting(
+    name = "tls_boringssl",
+    flag_values = {":tls": "boringssl"},
+)
+
+config_setting(
+    name = "tls_openssl",
+    flag_values = {":tls": "openssl"},
+)
+
+config_setting(
+    name = "tls_no",
+    flag_values = {":tls": "no"},
+)
+
+# The main clickhouse-cpp library. Downstream callers use
+# `#include <clickhouse/client.h>` and link `@clickhouse_cpp//:clickhouse`.
+cc_library(
+    name = "clickhouse",
+    srcs = glob(
+        [
+            "clickhouse/*.cpp",
+            "clickhouse/base/*.cpp",
+            "clickhouse/columns/*.cpp",
+            "clickhouse/types/*.cpp",
+        ],
+        # Only compiled when TLS is enabled, mirroring CMake's
+        # `IF (WITH_OPENSSL)` source-list append.
+        exclude = ["clickhouse/base/sslsocket.cpp"],
+    ) + select({
+        ":tls_no": [],
+        "//conditions:default": ["clickhouse/base/sslsocket.cpp"],
+    }),
+    hdrs = glob([
+        "clickhouse/*.h",
+        "clickhouse/base/*.h",
+        "clickhouse/columns/*.h",
+        "clickhouse/types/*.h",
+    ]),
+    defines = select({
+        # `WITH_OPENSSL` enables the TLS code paths in client.cpp /
+        # sslsocket.cpp (same macro as the CMake option). `USE_BORINGSSL`
+        # takes the BoringSSL-compatible branches in sslsocket.cpp.
+        ":tls_boringssl": [
+            "WITH_OPENSSL",
+            "USE_BORINGSSL",
+        ],
+        ":tls_openssl": ["WITH_OPENSSL"],
+        ":tls_no": [],
+    }),
+    # Expose headers at their workspace path so both internal
+    # (`#include "client.h"` from clickhouse/*.cpp via quote-form
+    # source-dir search) and external (`#include <clickhouse/client.h>`)
+    # include forms resolve.
+    strip_include_prefix = "/",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@abseil-cpp//absl/numeric:int128",
+        "@cityhash//:cityhash",
+        "@lz4//:lz4",
+        "@zstd//:zstd",
+    ] + select({
+        ":tls_boringssl": [
+            "@boringssl//:crypto",
+            "@boringssl//:ssl",
+        ],
+        ":tls_openssl": [
+            "@openssl//:crypto",
+            "@openssl//:ssl",
+        ],
+        ":tls_no": [],
+    }),
+)

MODULE.bazel

@@ -0,0 +1,14 @@
+module(name = "clickhouse_cpp", version = "2.6.1")
+
+# Pinned to 20260107.1, the last version that declares
+# `compatibility_level = 1`, so that the module remains importable on
+# Bazel < 9.1 whose bazel_tools also depends on a level-1 abseil-cpp.
+# See PR discussion; the attribute is a no-op from Bazel 9.1.0 onwards.
+bazel_dep(name = "abseil-cpp", version = "20260107.1")
+bazel_dep(name = "bazel_skylib", version = "1.9.0")
+bazel_dep(name = "boringssl", version = "0.20260526.0")
+bazel_dep(name = "cityhash", version = "1.0.2")
+bazel_dep(name = "lz4", version = "1.10.0.bcr.1")
+bazel_dep(name = "openssl", version = "3.5.5.bcr.4")
+bazel_dep(name = "rules_cc", version = "0.2.19")
+bazel_dep(name = "zstd", version = "1.5.7.bcr.1")