In a project built with Bazel I’m using --action_env to manually modify the build environment in order to avoid unwanted cache hits (this is a current workaround for a more sophisticated solution, but for now I’m interested in this question generally).

Currently I’m wrapping bazel run into a shell script which appends --action_env and --host_action_env and also checks the provided value for validity.
I now want to want to move the validity checks into the bazel world, in order to run them every time bazel build gets invoked.

Is there a way to create a rule or function which gets executed every time (or at least once every time the provided values change) and regardless of the target I want to build?

Something like

BUILD

load("//:check_env.bzl", "check_environment_variables")
check_environment_variables()

check_env.bzl

def _check_environment_variables(ctx):
    my_env = ctx.attr.env_var["MY_ENV"]
    print("provided value for MY_ENV:", my_env)
    if not my_env == "foo":
        fail("MY_ENV must be set to 'foo'")
    return []    

check_environment_variables = rule(
    implementation=_check_environment_variables,
    attrs={},
)

but while Bazel does not complain about this approach, it’s check_environment_variables won’t be executed neither..