Add Bazel unit test target and Windows (MSVC) support

.github/workflows/bazel.yml

@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04, macos-latest]
+        os: [ubuntu-24.04, macos-latest, windows-latest]
         tls: [boringssl, openssl, 'no']
 
     runs-on: ${{ matrix.os }}
@@ -41,3 +41,6 @@ jobs:
 
       - name: Build project
         run: bazel build //... --@clickhouse_cpp//:tls=${{ matrix.tls }}
+
+      - name: Run unit tests
+        run: bazel test //ut:unit_tests --@clickhouse_cpp//:tls=${{ matrix.tls }} --test_output=errors

BUILD.bazel

@@ -1,3 +1,4 @@
+load("@bazel_skylib//lib:selects.bzl", "selects")
 load("@bazel_skylib//rules:common_settings.bzl", "string_flag")
 load("@rules_cc//cc:cc_library.bzl", "cc_library")
 
@@ -46,6 +47,17 @@ config_setting(
     flag_values = {":tls": "no"},
 )
 
+# OpenSSL on Windows pulls in Win32 system libraries (the cert store via
+# crypt32, plus user32) that BoringSSL bundles itself. Used to gate the
+# extra linkopts below.
+selects.config_setting_group(
+    name = "tls_openssl_on_windows",
+    match_all = [
+        ":tls_openssl",
+        "@platforms//os:windows",
+    ],
+)
+
 # The main clickhouse-cpp library. Downstream callers use
 # `#include <clickhouse/client.h>` and link `@clickhouse_cpp//:clickhouse`.
 cc_library(
@@ -81,6 +93,25 @@ cc_library(
         ":tls_openssl": ["WITH_OPENSSL"],
         ":tls_no": [],
     }),
+    # Winsock, required by base/socket.cpp et al. Mirrors CMake's
+    # `IF (WIN32 OR MINGW)` link block. (The BoringSSL backend already
+    # propagates ws2_32 itself; declare it explicitly so the openssl
+    # and no-TLS configurations link too.)
+    linkopts = select({
+        "@platforms//os:windows": [
+            "-DEFAULTLIB:ws2_32.lib",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        # OpenSSL references the Win32 cert store and user32; declare
+        # them so downstream executables link without each consumer
+        # having to repeat it. Mirrors CMake's MSVC `Crypt32` link.
+        ":tls_openssl_on_windows": [
+            "-DEFAULTLIB:crypt32.lib",
+            "-DEFAULTLIB:user32.lib",
+        ],
+        "//conditions:default": [],
+    }),
     # Expose headers at their workspace path so both internal
     # (`#include "client.h"` from clickhouse/*.cpp via quote-form
     # source-dir search) and external (`#include <clickhouse/client.h>`)

MODULE.bazel

@@ -10,5 +10,9 @@ bazel_dep(name = "boringssl", version = "0.20260526.0")
 bazel_dep(name = "cityhash", version = "1.0.2")
 bazel_dep(name = "lz4", version = "1.10.0.bcr.1")
 bazel_dep(name = "openssl", version = "3.5.5.bcr.4")
+bazel_dep(name = "platforms", version = "1.1.0")
 bazel_dep(name = "rules_cc", version = "0.2.19")
 bazel_dep(name = "zstd", version = "1.5.7.bcr.1")
+
+# Test-only dependencies; not pulled in by consumers of the library.
+bazel_dep(name = "googletest", version = "1.17.0.bcr.2", dev_dependency = True)

ut/BUILD.bazel

@@ -0,0 +1,54 @@
+load("@rules_cc//cc:cc_test.bzl", "cc_test")
+
+# Hermetic subset of the googletest suite in this directory: only the
+# tests that do not need a running ClickHouse server. The remaining
+# files (client_ut.cpp, roundtrip_tests.cpp, Column_ut.cpp, ...) connect
+# to $CLICKHOUSE_HOST and stay CMake-only for now, where CI provides a
+# server via docker-compose (see .github/workflows/linux.yml).
+#
+# socket_ut.cpp is included: it spins up its own LocalTcpServer on
+# localhost, which works inside the Bazel test sandbox.
+cc_test(
+    name = "unit_tests",
+    size = "small",
+    srcs = [
+        # Test cases.
+        "CreateColumnByType_ut.cpp",
+        "block_ut.cpp",
+        "column_array_ut.cpp",
+        "columns_ut.cpp",
+        "itemview_ut.cpp",
+        "socket_ut.cpp",
+        "stream_ut.cpp",
+        "type_parser_ut.cpp",
+        "types_ut.cpp",
+        "utils_ut.cpp",
+        # Test entry point and shared support code.
+        "main.cpp",
+        "tcp_server.cpp",
+        "tcp_server.h",
+        "utils.cpp",
+        "utils.h",
+        "utils_comparison.h",
+        "utils_meta.h",
+        "value_generators.cpp",
+        "value_generators.h",
+    ] + select({
+        # Link guard for the TLS code path; sslsocket.cpp (and the
+        # system libs it needs) only exist when TLS is enabled.
+        "//:tls_no": [],
+        "//conditions:default": ["ssl_link_ut.cpp"],
+    }),
+    # Some tests include support headers via the angled
+    # `#include <ut/utils.h>` form; expose the repo root for those.
+    # /bigobj mirrors CMake's MSVC handling for this test binary.
+    copts = ["-I."] + select({
+        "@platforms//os:windows": ["/bigobj"],
+        "//conditions:default": [],
+    }),
+    deps = [
+        "//:clickhouse",
+        "@abseil-cpp//absl/numeric:int128",
+        "@googletest//:gtest",
+    ],
+)

ut/ssl_link_ut.cpp

@@ -0,0 +1,26 @@
+#include <clickhouse/base/sslsocket.h>
+
+#include <gtest/gtest.h>
+
+// Link/compile guard for the TLS code path.
+//
+// A library-only `bazel build //:clickhouse` produces a static archive
+// and never runs the linker, so missing system libraries (on Windows,
+// the Win32 cert store `crypt32` and `user32` that OpenSSL needs) stay
+// invisible until a *consumer* links an executable that actually pulls
+// in sslsocket.obj. The hermetic unit_tests subset doesn't touch SSL,
+// so it didn't surface them either.
+//
+// Constructing an SSLContext drags sslsocket.obj — and transitively the
+// SSL_CTX_*/X509_* symbols and their system-lib dependencies — into the
+// test binary's link step. Default-constructed params do no CA loading
+// and open no socket, so this runs in the hermetic sandbox while still
+// exercising the link that previously only broke for downstream users.
+//
+// Only compiled when TLS is enabled (excluded for tls=no, where
+// sslsocket.cpp isn't part of the library); see ut/BUILD.bazel.
+TEST(SSLLink, ConstructContext) {
+    clickhouse::SSLParams params{};
+    clickhouse::SSLContext context(params);
+    SUCCEED();
+}