Add Bazel build with BoringSSL support

.github/workflows/bazel.yml

@@ -0,0 +1,43 @@
+name: Bazel
+
+on:
+  schedule:
+    - cron: '0 0 * * 1'
+  push:
+    branches: [ '*' ]
+  pull_request:
+    branches: [ master ]
+
+  release:
+    types:
+      - published
+      - prereleased
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-latest]
+        tls: [boringssl, openssl]
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 100
+          fetch-tags: true
+
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.15.0
+        with:
+          bazelisk-cache: true
+          disk-cache: true
+          repository-cache: true
+
+      - name: Build project
+        run: bazel build //... --@clickhouse_cpp//:tls=${{ matrix.tls }}

.gitignore

@@ -281,3 +281,6 @@ BUCKAROO_DEPS
 
 # clangd cache
 /.cache/clangd
+
+# Bazel
+/bazel-*

BUILD.bazel

@@ -0,0 +1,86 @@
+load("@bazel_skylib//rules:common_settings.bzl", "string_flag")
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+
+# Bazel build for clickhouse-cpp. The canonical build is CMake
+# (top-level CMakeLists.txt); this file mirrors the same library as
+# a bzlmod target so downstream Bazel projects can depend on it via
+# the Bazel Central Registry without standing up CMake.
+#
+# Differences from the CMake build that callers should be aware of:
+#   * TLS links against BoringSSL (`@boringssl`) by default; pass
+#     `--@clickhouse_cpp//:tls=openssl` to use the BCR OpenSSL module
+#     instead. `USE_BORINGSSL` ifdef-guards the two OpenSSL-only
+#     surfaces (`SSL_CONF_*` command API and `SSL_read_ex`) that
+#     BoringSSL doesn't provide; see clickhouse/base/sslsocket.cpp.
+#   * cityhash / lz4 / zstd / abseil come from BCR modules instead of
+#     contrib/; the contrib/ trees are only used by the CMake build.
+
+# Selects the TLS implementation: `--@clickhouse_cpp//:tls=boringssl`
+# (default) or `--@clickhouse_cpp//:tls=openssl`. Both come from BCR
+# modules and are linked statically, keeping the build hermetic.
+string_flag(
+    name = "tls",
+    build_setting_default = "boringssl",
+    values = [
+        "boringssl",
+        "openssl",
+    ],
+)
+
+config_setting(
+    name = "tls_boringssl",
+    flag_values = {":tls": "boringssl"},
+)
+
+config_setting(
+    name = "tls_openssl",
+    flag_values = {":tls": "openssl"},
+)
+
+# The main clickhouse-cpp library. Downstream callers use
+# `#include <clickhouse/client.h>` and link `@clickhouse_cpp//:clickhouse`.
+cc_library(
+    name = "clickhouse",
+    srcs = glob([
+        "clickhouse/*.cpp",
+        "clickhouse/base/*.cpp",
+        "clickhouse/columns/*.cpp",
+        "clickhouse/types/*.cpp",
+    ]),
+    hdrs = glob([
+        "clickhouse/*.h",
+        "clickhouse/base/*.h",
+        "clickhouse/columns/*.h",
+        "clickhouse/types/*.h",
+    ]),
+    defines = [
+        # Enable the TLS code paths in client.cpp / sslsocket.cpp.
+        # Matches CMake's `option(WITH_OPENSSL ON)`.
+        "WITH_OPENSSL",
+    ] + select({
+        # Take the BoringSSL-compatible branches in sslsocket.cpp.
+        ":tls_boringssl": ["USE_BORINGSSL"],
+        ":tls_openssl": [],
+    }),
+    # Expose headers at their workspace path so both internal
+    # (`#include "client.h"` from clickhouse/*.cpp via quote-form
+    # source-dir search) and external (`#include <clickhouse/client.h>`)
+    # include forms resolve.
+    strip_include_prefix = "/",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@abseil-cpp//absl/numeric:int128",
+        "@cityhash//:cityhash",
+        "@lz4//:lz4",
+        "@zstd//:zstd",
+    ] + select({
+        ":tls_boringssl": [
+            "@boringssl//:crypto",
+            "@boringssl//:ssl",
+        ],
+        ":tls_openssl": [
+            "@openssl//:crypto",
+            "@openssl//:ssl",
+        ],
+    }),
+)

MODULE.bazel

@@ -0,0 +1,10 @@
+module(name = "clickhouse_cpp", version = "2.6.1")
+
+bazel_dep(name = "abseil-cpp", version = "20260526.0")
+bazel_dep(name = "bazel_skylib", version = "1.9.0")
+bazel_dep(name = "boringssl", version = "0.20260526.0")
+bazel_dep(name = "cityhash", version = "1.0.2")
+bazel_dep(name = "lz4", version = "1.10.0.bcr.1")
+bazel_dep(name = "openssl", version = "3.5.5.bcr.4")
+bazel_dep(name = "rules_cc", version = "0.2.19")
+bazel_dep(name = "zstd", version = "1.5.7.bcr.1")