Another option: drake-ros/bazel_ros2_rules at main · RobotLocomotion/drake-ros · GitHub
To use this option you add a repository rule to your WORKSPACE file that points to a ROS workspace. This can be a system install of ROS like /opt/ros/<distro> or a tarball. Your targets can then depend on packages in that ROS workspace with labels like @ros2//:rclcpp_cc, or @ros2//:visualization_msgs_py, etc.
You don’t have to rewrite the build system for packages using ROS 2; however, if you want “reproducible” and “traceable” you’re responsible for building and hosting your own tarball somewhere. Further, the ROS packages are going to depend on system dependencies, which -if I understand correctly- isn’t “hermetic” or “traceable” in bazel.