Ensure public read policy on S3 artifacts bucket

The Tauri updater requires anonymous read access to fetch application artifacts. This change ensures that the S3 bucket used for storing these artifacts always has a public read policy applied, both upon initial creation and during subsequent checks.

cicd_tool/main.py

@@ -81,6 +81,23 @@ def _create_minio_client() -> Minio:
     )
 
 
+def _public_read_policy(bucket_name: str) -> str:
+    """Anonymous read-only policy so the Tauri updater can fetch artifacts."""
+    return json.dumps(
+        {
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Effect": "Allow",
+                    "Principal": {"AWS": ["*"]},
+                    "Action": ["s3:GetObject"],
+                    "Resource": [f"arn:aws:s3:::{bucket_name}/*"],
+                }
+            ],
+        }
+    )
+
+
 def _ensure_bucket(client: Minio, bucket_name: str) -> None:
     if not bucket_name:
         raise ConfigurationError("S3_BUCKET is required")
@@ -88,6 +105,12 @@ def _ensure_bucket(client: Minio, bucket_name: str) -> None:
     exists = client.bucket_exists(bucket_name)
     if not exists:
         client.make_bucket(bucket_name)
+        print(f"Created bucket '{bucket_name}'.")
+
+    # Always (re)apply public read so a freshly created -- or previously private --
+    # bucket can be read anonymously by the updater.
+    client.set_bucket_policy(bucket_name, _public_read_policy(bucket_name))
+    print(f"Ensured public read policy on bucket '{bucket_name}'.")
 
 
 def _collect_artifacts() -> List[Path]: