There's also (I believe experimental) support for using Docker as a sandbox backend. That ends up being useful if you're using the remote build execution support: you can run a build locally in exactly the same environment it will run on a build farm.
(I once accidentally baked a time and random number into a binary myself - and the random number thing would have been a serious security bug if we had not found it with test coverage. Would have been better if the build system disallowed it.)
They already have support for build times and labels, but you can add arbitrary stuff like got hashes too
You can of course define these as variables, but that'll just drop all your caches on each build which eliminates the main selling point of Bazel.