[RB] Support passing a different API key for uploading build events

Author: maggie-lou

app/invocation/invocation_action_card.tsx

@@ -657,7 +657,8 @@ export default class InvocationActionCardComponent extends React.Component<Props
   ) {
     const snapshotKey = this.getSnapshotKeyForSnapshotID(vmMetadata);
     const snapshotKeyJSON = JSON.stringify(snapshotKey);
-    const cmd = `bb remote --run_from_snapshot='${snapshotKeyJSON}' --runner_exec_properties=debug-executor-id=${executionMetadata.executorId} --script='echo "My custom bash command!"'`;
+    const impersonationAPIKey = this.state.user?.isImpersonating ? `--remote_run_header=x-buildbuddy-platform.env-overrides=BUILDBUDDY_BES_API_KEY=[SET BB ORG API KEY]>` : "";
+    const cmd = `bb remote ${impersonationAPIKey} --run_from_snapshot='${snapshotKeyJSON}' --runner_exec_properties=debug-executor-id=${executionMetadata.executorId} --script='echo "My custom bash command!"'`;
     copyToClipboard(cmd);
     alert_service.success("Command copied to clipboard");
     this.setState({ showSnapshotMenu: false });

enterprise/server/cmd/ci_runner/main.go

@@ -680,9 +680,13 @@ func run() error {
 		defer cancel()
 	}
 
+	besAPIKey := os.Getenv("BUILDBUDDY_BES_API_KEY")
+	if besAPIKey == "" {
+		besAPIKey = ws.buildbuddyAPIKey
+	}
 	// Use a context without a timeout for the build event reporter, so that even
 	// if the `timeout` is reached, any events will finish getting published
-	buildEventReporter, err := newBuildEventReporter(contextWithoutTimeout, *besBackend, ws.buildbuddyAPIKey, *invocationID, *workflowID != "" /*=isWorkflow*/)
+	buildEventReporter, err := newBuildEventReporter(contextWithoutTimeout, *besBackend, besAPIKey, *invocationID, *workflowID != "" /*=isWorkflow*/)
 	if err != nil {
 		return err
 	}