Fail stale PolicyEngine US dependency in PR checks

.github/workflows/pr.yaml

@@ -35,17 +35,17 @@ jobs:
             exit 1
           }
 
-  policyengine-us-freshness:
-    name: PolicyEngine US freshness
+  require-current-policyengine-us:
+    name: Require current PolicyEngine US dependency
     runs-on: ubuntu-latest
     needs: check-fork
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: "3.14"
-      - name: Warn if policyengine-us is stale
-        run: python .github/scripts/check_policyengine_us_dependency.py --mode warn
+      - name: Require current policyengine-us pin
+        run: python .github/scripts/check_policyengine_us_dependency.py --mode fail
 
   lint:
     runs-on: ubuntu-latest

changelog.d/1009.fixed

@@ -0,0 +1 @@
+Fail PR checks when the pinned policyengine-us data-build dependency is stale.

pyproject.toml

@@ -22,7 +22,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dependencies = [
-    "policyengine-us==1.693.4",
+    "policyengine-us==1.693.5",
     # policyengine-core 3.26.1 is the current 3.26.x runtime and includes the fix for
     # PolicyEngine/policyengine-core#482 (user-set ETERNITY inputs lost
     # after _invalidate_all_caches) and is required by policyengine-us 1.682.1+.

tests/unit/test_publication_scripts.py

@@ -348,6 +348,18 @@ def test_policyengine_us_dependency_check_allow_stale_keeps_local_errors_fatal(
     assert module.main() == 1
 
 
+def test_pr_workflow_fails_on_stale_policyengine_us_dependency():
+    workflow = (REPO_ROOT / ".github/workflows/pr.yaml").read_text()
+
+    assert "require-current-policyengine-us:" in workflow
+    assert "name: Require current PolicyEngine US dependency" in workflow
+    assert (
+        "python .github/scripts/check_policyengine_us_dependency.py --mode fail"
+        in workflow
+    )
+    assert "check_policyengine_us_dependency.py --mode warn" not in workflow
+
+
 def test_restore_publication_changelog_restores_candidate_snapshot(
     tmp_path,
     monkeypatch,