There are several solutions.
The cleanest way is to perform validation during build: you create a genrule for each file (or batch of files) that you want to verify, and if the verification succeeds, genrule outputs something, if that fails, then the rule does not output anything, which automatically also leads to a build failure.
Since the success of the check depends on the contents of the file, and the same input should give the same result, genrules should create an output file that depends on the contents of the input (s). The most convenient thing is to write the digest of the file (s) to the output if the verification is successful, and there is no output if the verification failed.
To re-validate with a verifier, you can create a Skylark macro and use it in all of your packages.
To put it all together, you should write something like the following.
Contents //tools:py_verify_test.bzl :
def py_verify_test(name, srcs, visibility = None): rules = {"%s-file%d" % (name, hash(s)): s for s in srcs} for rulename, src in rules.items(): native.genrule( name = rulename, srcs = [s], outs = ["%s.md5" % rulename], cmd = "$(location //tools:py_verifier) $< && md5sum $< > $@ ", tools = ["//tools:py_verifier"], visibility = ["//visibility:private"], ) native.sh_test( name = name, srcs = ["//tools:build_test.sh"], data = rules.keys(), visibility = visibility, )
Contents //tools:build_test.sh :
#!/bin/true
Contents //tools:BUILD :
The contents of any package that wants to check files:
load("//tools:py_verify_test.bzl", "py_verify_test") py_verify_test( name = "verify", srcs = glob(["**/*.py"]), )