buildbucket: use OptionalLogin if service account is not passed

client/cmd/buildbucket/base_command.go

Index: client/cmd/buildbucket/base_command.go
diff --git a/client/cmd/buildbucket/base_command.go b/client/cmd/buildbucket/base_command.go
index 31e26e507911071e74a56c006980f570cd9091e2..856e257752a6e7aace95b516cfa5e1150f3dfe89 100644
--- a/client/cmd/buildbucket/base_command.go
+++ b/client/cmd/buildbucket/base_command.go
@@ -36,7 +36,14 @@ func (r *baseCommandRun) makeService(ctx context.Context, a subcommands.Applicat
 	if r.host == "" {
 		return nil, errors.New("a host for the buildbucket service must be provided")
 	}
-	authenticator := auth.NewAuthenticator(ctx, auth.SilentLogin, auth.Options{ServiceAccountJSONPath: r.serviceAccountJSONPath})
+
+	loginMode := auth.OptionalLogin
+	if r.serviceAccountJSONPath != "" {
+		// if service account is specified, the request MUST be authenticated
+		// otherwise it is optional.
+		loginMode = auth.SilentLogin
+	}
+	authenticator := auth.NewAuthenticator(ctx, loginMode, auth.Options{ServiceAccountJSONPath: r.serviceAccountJSONPath})
 
 	client, err := authenticator.Client()
 	if err != nil {