Fail CI on stale PolicyEngine US dependency

.github/workflows/pr.yaml

@@ -44,8 +44,8 @@ jobs:
       - uses: actions/setup-python@v6
         with:
           python-version: "3.14"
-      - name: Warn if policyengine-us is stale
-        run: python .github/scripts/check_policyengine_us_dependency.py --mode warn
+      - name: Require current PolicyEngine US dependency
+        run: python .github/scripts/check_policyengine_us_dependency.py --mode fail
 
   lint:
     runs-on: ubuntu-latest

.github/workflows/push.yaml

@@ -30,6 +30,17 @@ jobs:
         id: run-context
         run: python .github/scripts/resolve_run_context.py
 
+  policyengine-us-freshness:
+    name: PolicyEngine US freshness
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.14"
+      - name: Require current PolicyEngine US dependency
+        run: python .github/scripts/check_policyengine_us_dependency.py --mode fail
+
   # ── Documentation ──────────────────────────────────────────
   docs:
     name: Documentation
@@ -66,7 +77,9 @@ jobs:
   versioning:
     name: Versioning
     runs-on: ubuntu-latest
-    needs: run-context
+    needs:
+      - run-context
+      - policyengine-us-freshness
     if: |
       github.event.head_commit.message != 'Update publication candidate' &&
       github.event.head_commit.message != 'Finalize package version'
@@ -112,6 +125,7 @@ jobs:
     needs:
       - lint
       - run-context
+      - policyengine-us-freshness
     if: github.event.head_commit.message == 'Update publication candidate'
     permissions:
       actions: write

changelog.d/1009.fixed.md

@@ -0,0 +1 @@
+Fail CI when policyengine-us is stale before publication.

pyproject.toml

@@ -22,7 +22,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dependencies = [
-    "policyengine-us==1.693.4",
+    "policyengine-us==1.693.5",
     # policyengine-core 3.26.1 is the current 3.26.x runtime and includes the fix for
     # PolicyEngine/policyengine-core#482 (user-set ETERNITY inputs lost
     # after _invalidate_all_caches) and is required by policyengine-us 1.682.1+.