From 3fa2f7798285338d5b23f2da79b059b4e182b0f2 Mon Sep 17 00:00:00 2001
From: Giles Westwood <201443+gilesw@users.noreply.github.com>
Date: Wed, 28 Oct 2026 15:00:18 +0000
Subject: [PATCH 1/5] Smoke test the installed deb with below --help

below has no --version flag.
---
 scripts/test_deb.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/test_deb.sh b/scripts/test_deb.sh
index 131b8c3e..26f6e4b5 100755
--- a/scripts/test_deb.sh
+++ b/scripts/test_deb.sh
@@ -41,5 +41,5 @@ done
 # Not /tmp: systemd may mount a tmpfs over it after docker cp has written there.
 docker cp "$deb" "$container:/root/below.deb"
 docker exec "$container" apt-get install -y -qq /root/below.deb
-docker exec "$container" below --version
+docker exec "$container" below --help >/dev/null
 docker exec "$container" systemctl is-enabled below

From acd58e7a17c3c00dff2ab8a167966d0a65854c3d Mon Sep 17 00:00:00 2001
From: Giles Westwood <201443+gilesw@users.noreply.github.com>
Date: Wed, 28 Oct 2026 15:01:38 +0000
Subject: [PATCH 2/5] Add --version

The version is BELOW_VERSION when set at build time, otherwise the crate
version. build.yml sets it from scripts/version.sh, which package_deb.sh
now also uses, so below --version matches the deb version. test_deb.sh
checks that they match.
---
 .github/workflows/build.yml |  3 ++-
 below/src/main.rs           |  1 +
 scripts/package_deb.sh      | 11 +----------
 scripts/test_deb.sh         |  5 +++--
 scripts/version.sh          | 33 +++++++++++++++++++++++++++++++++
 5 files changed, 40 insertions(+), 13 deletions(-)
 create mode 100755 scripts/version.sh

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9fab6b02..79dd3fc2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -40,7 +40,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          # package_deb.sh versions the package from the release tag.
+          # version.sh versions the build from the release tag.
           fetch-depth: 0
       - run: >
           sudo apt-get update &&
@@ -50,6 +50,7 @@ jobs:
           components: rustfmt
       - uses: Swatinem/rust-cache@v2
       - run: cargo install --locked cargo-deb
+      - run: echo "BELOW_VERSION=$(scripts/version.sh)" >> "$GITHUB_ENV"
       - run: cargo build --release --locked --package below --target "$TARGET"
       # Skip tests that require host to have cgroup2
       - run: >
diff --git a/below/src/main.rs b/below/src/main.rs
index d552035a..6d8b8bc0 100644
--- a/below/src/main.rs
+++ b/below/src/main.rs
@@ -90,6 +90,7 @@ open_source_shim!();
 static LIVE_REMOTE_MAX_LATENCY_SEC: u64 = 10;
 
 #[derive(Debug, Parser)]
+#[clap(version = option_env!("BELOW_VERSION").unwrap_or(env!("CARGO_PKG_VERSION")))]
 struct Opt {
     #[clap(long, value_parser, default_value = config::BELOW_DEFAULT_CONF)]
     config: PathBuf,
diff --git a/scripts/package_deb.sh b/scripts/package_deb.sh
index 45bb92a2..1ff8f364 100755
--- a/scripts/package_deb.sh
+++ b/scripts/package_deb.sh
@@ -23,15 +23,6 @@ set -eu
 cd "$(dirname "$(realpath "$0")")"/..
 
 triple=$1
-crate_version=$(sed -n 's/^version = "\(.*\)"/\1/p' below/Cargo.toml | head -1)
-
-# Commits since the v<crate_version> tag sort after that release and before the next.
-describe=$(git describe --tags --match "v$crate_version" --long --abbrev=12)
-since=$(sed -E 's/^.*-([0-9]+)-g[0-9a-f]+$/\1/' <<<"$describe")
-commit=$(sed -E 's/^.*-g([0-9a-f]+)$/\1/' <<<"$describe")
-version=$crate_version
-if [ "$since" != 0 ]; then
-  version="$crate_version+git$since.$commit"
-fi
+version=$(scripts/version.sh)
 
 cargo deb --package below --no-build --target "$triple" --deb-version "$version"
diff --git a/scripts/test_deb.sh b/scripts/test_deb.sh
index 26f6e4b5..7d21e0b5 100755
--- a/scripts/test_deb.sh
+++ b/scripts/test_deb.sh
@@ -15,7 +15,7 @@
 # limitations under the License.
 
 # Install a below .deb in an Ubuntu container running systemd and check the
-# binary runs and the recording service is enabled.
+# binary reports the package version and the recording service is enabled.
 #   scripts/test_deb.sh <path/to/below.deb> [image]
 
 set -eu
@@ -41,5 +41,6 @@ done
 # Not /tmp: systemd may mount a tmpfs over it after docker cp has written there.
 docker cp "$deb" "$container:/root/below.deb"
 docker exec "$container" apt-get install -y -qq /root/below.deb
-docker exec "$container" below --help >/dev/null
+docker exec "$container" below --version
+test "$(docker exec "$container" below --version)" = "below $(dpkg-deb --field "$deb" Version)"
 docker exec "$container" systemctl is-enabled below
diff --git a/scripts/version.sh b/scripts/version.sh
new file mode 100755
index 00000000..8cef9df2
--- /dev/null
+++ b/scripts/version.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+#
+# Copyright (c) Facebook, Inc. and its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+# Print the version for a build of this checkout. Commits since the
+# v<crate version> tag sort after that release and before the next.
+
+set -eu
+
+cd "$(dirname "$(realpath "$0")")"/..
+
+crate_version=$(sed -n 's/^version = "\(.*\)"/\1/p' below/Cargo.toml | head -1)
+describe=$(git describe --tags --match "v$crate_version" --long --abbrev=12)
+since=$(sed -E 's/^.*-([0-9]+)-g[0-9a-f]+$/\1/' <<<"$describe")
+commit=$(sed -E 's/^.*-g([0-9a-f]+)$/\1/' <<<"$describe")
+if [ "$since" = 0 ]; then
+  echo "$crate_version"
+else
+  echo "$crate_version+git$since.$commit"
+fi

From 822a8599c8c3eb8b1932d6af55422dfb58f397ea Mon Sep 17 00:00:00 2001
From: Giles Westwood <201443+gilesw@users.noreply.github.com>
Date: Wed, 28 Oct 2026 17:28:21 +0000
Subject: [PATCH 3/5] Version releases from Cargo.toml and bump to 0.12.0

below --version prints the crate version. release.yml runs on vX.Y.Z
tags and fails unless the tag matches below/Cargo.toml, and cargo deb
takes the package version from the manifest, so the binary, the deb and
the release all carry the same version. This replaces the git describe
version from scripts/version.sh.
---
 .github/workflows/build.yml   |  4 ----
 .github/workflows/release.yml | 10 +++++++++-
 Cargo.lock                    | 34 +++++++++++++++++-----------------
 below/Cargo.toml              | 22 +++++++++++-----------
 below/below_derive/Cargo.toml |  2 +-
 below/btrfs/Cargo.toml        |  4 ++--
 below/cgroupfs/Cargo.toml     |  8 ++++----
 below/common/Cargo.toml       |  2 +-
 below/config/Cargo.toml       |  8 ++++----
 below/dump/Cargo.toml         | 12 ++++++------
 below/ethtool/Cargo.toml      |  2 +-
 below/gpu_stats/Cargo.toml    |  4 ++--
 below/model/Cargo.toml        | 20 ++++++++++----------
 below/procfs/Cargo.toml       |  4 ++--
 below/render/Cargo.toml       |  6 +++---
 below/resctrlfs/Cargo.toml    |  4 ++--
 below/src/main.rs             |  2 +-
 below/store/Cargo.toml        |  6 +++---
 below/tc/Cargo.toml           |  2 +-
 below/view/Cargo.toml         | 12 ++++++------
 below/vmlinux/Cargo.toml      |  2 +-
 docs/building.md              |  7 ++++---
 scripts/package_deb.sh        |  5 +----
 scripts/test_deb.sh           |  3 ++-
 scripts/version.sh            | 33 ---------------------------------
 25 files changed, 94 insertions(+), 124 deletions(-)
 delete mode 100755 scripts/version.sh

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 79dd3fc2..5f320def 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -39,9 +39,6 @@ jobs:
       TARGET: ${{ matrix.arch }}-unknown-linux-gnu
     steps:
       - uses: actions/checkout@v4
-        with:
-          # version.sh versions the build from the release tag.
-          fetch-depth: 0
       - run: >
           sudo apt-get update &&
           sudo apt-get install -y clang-15 libelf-dev m4 pkg-config zlib1g-dev
@@ -50,7 +47,6 @@ jobs:
           components: rustfmt
       - uses: Swatinem/rust-cache@v2
       - run: cargo install --locked cargo-deb
-      - run: echo "BELOW_VERSION=$(scripts/version.sh)" >> "$GITHUB_ENV"
       - run: cargo build --release --locked --package below --target "$TARGET"
       # Skip tests that require host to have cgroup2
       - run: >
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c14d8d70..3dad89b2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,7 +2,7 @@ name: release
 
 on:
   push:
-    tags: ["v*"]
+    tags: ["v[0-9]+.[0-9]+.[0-9]+"]
 
 permissions:
   contents: read
@@ -12,7 +12,15 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check the tag matches the Cargo.toml version
+        run: grep -qx "version = \"${GITHUB_REF_NAME#v}\"" below/Cargo.toml
+
   build:
+    needs: version
     uses: ./.github/workflows/build.yml
     with:
       upload: true
diff --git a/Cargo.lock b/Cargo.lock
index 76845fab..067e1f08 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -108,7 +108,7 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "below"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
  "below-common",
@@ -146,7 +146,7 @@ dependencies = [
 
 [[package]]
 name = "below-btrfs"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "below-common",
  "libc",
@@ -161,7 +161,7 @@ dependencies = [
 
 [[package]]
 name = "below-common"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
  "chrono",
@@ -177,7 +177,7 @@ dependencies = [
 
 [[package]]
 name = "below-config"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
  "below-btrfs",
@@ -190,7 +190,7 @@ dependencies = [
 
 [[package]]
 name = "below-dump"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
  "below-common",
@@ -209,7 +209,7 @@ dependencies = [
 
 [[package]]
 name = "below-ethtool"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "nix",
  "serde",
@@ -218,7 +218,7 @@ dependencies = [
 
 [[package]]
 name = "below-gpu-stats"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "below-common",
  "serde",
@@ -226,7 +226,7 @@ dependencies = [
 
 [[package]]
 name = "below-model"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -251,7 +251,7 @@ dependencies = [
 
 [[package]]
 name = "below-render"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "below-common",
  "below-model",
@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "below-store"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
  "below-common",
@@ -285,7 +285,7 @@ dependencies = [
 
 [[package]]
 name = "below-tc"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "netlink-packet-core",
  "netlink-packet-route",
@@ -297,7 +297,7 @@ dependencies = [
 
 [[package]]
 name = "below-view"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
  "below-common",
@@ -320,11 +320,11 @@ dependencies = [
 
 [[package]]
 name = "below-vmlinux"
-version = "0.11.0"
+version = "0.12.0"
 
 [[package]]
 name = "below_derive"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -466,7 +466,7 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "cgroupfs"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
  "below-common",
@@ -979,7 +979,7 @@ checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
 name = "fb_procfs"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "below-common",
  "libc",
@@ -2106,7 +2106,7 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "resctrlfs"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "below-common",
  "maplit",
diff --git a/below/Cargo.toml b/below/Cargo.toml
index eb5b4593..71e57042 100644
--- a/below/Cargo.toml
+++ b/below/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "An interactive tool to view and record historical system data"
@@ -22,21 +22,21 @@ unit-scripts = "../etc"
 
 [dependencies]
 anyhow = "1.0.104"
-below-vmlinux = { version = "0.11.0", path = "vmlinux" }
-cgroupfs = { version = "0.11.0", path = "cgroupfs" }
+below-vmlinux = { version = "0.12.0", path = "vmlinux" }
+cgroupfs = { version = "0.12.0", path = "cgroupfs" }
 clap = { version = "4.6.2", features = ["derive", "env", "string", "unicode", "wrap_help"] }
 clap_complete = { version = "4.6.11", features = ["unstable-dynamic"] }
-common = { package = "below-common", version = "0.11.0", path = "common" }
-config = { package = "below-config", version = "0.11.0", path = "config" }
+common = { package = "below-common", version = "0.12.0", path = "common" }
+config = { package = "below-config", version = "0.12.0", path = "config" }
 cursive = { version = "0.21.1", features = ["crossterm-backend"], default-features = false }
-dump = { package = "below-dump", version = "0.11.0", path = "dump" }
+dump = { package = "below-dump", version = "0.12.0", path = "dump" }
 indicatif = { version = "0.18.6", features = ["futures", "improved_unicode", "rayon", "tokio"] }
 libbpf-rs = { version = "0.27.2", default-features = false }
 libc = "0.2.186"
-model = { package = "below-model", version = "0.11.0", path = "model" }
+model = { package = "below-model", version = "0.12.0", path = "model" }
 nix = { version = "0.31.3", features = ["dir", "event", "hostname", "inotify", "ioctl", "mman", "mount", "net", "poll", "ptrace", "reboot", "resource", "sched", "signal", "term", "time", "user", "zerocopy"] }
 plain = "0.2"
-procfs = { package = "fb_procfs", version = "0.11.0", path = "procfs" }
+procfs = { package = "fb_procfs", version = "0.12.0", path = "procfs" }
 regex = "1.13.1"
 scopeguard = "1.2.0"
 sd-notify = "0.4.5"
@@ -45,18 +45,18 @@ serde_json = { version = "1.0.154", features = ["alloc", "float_roundtrip", "raw
 signal-hook = "0.3.18"
 slog = { version = "2.8.2", features = ["max_level_trace", "nested-values"] }
 slog-term = "2.9.2"
-store = { package = "below-store", version = "0.11.0", path = "store" }
+store = { package = "below-store", version = "0.12.0", path = "store" }
 tar = "0.4.46"
 tempfile = "3.27.0"
 tokio = { version = "1.53.2", features = ["full", "test-util", "tracing"] }
-view = { package = "below-view", version = "0.11.0", path = "view" }
+view = { package = "below-view", version = "0.12.0", path = "view" }
 
 [dev-dependencies]
 maplit = "1.0"
 portpicker = "0.1.1"
 
 [build-dependencies]
-below-vmlinux = { version = "0.11.0", path = "vmlinux" }
+below-vmlinux = { version = "0.12.0", path = "vmlinux" }
 libbpf-cargo = { version = "0.27.2", default-features = false }
 
 [features]
diff --git a/below/below_derive/Cargo.toml b/below/below_derive/Cargo.toml
index d0e8a2b2..1ec1621c 100644
--- a/below/below_derive/Cargo.toml
+++ b/below/below_derive/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below_derive"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "Proc macros for below"
diff --git a/below/btrfs/Cargo.toml b/below/btrfs/Cargo.toml
index abb6a316..190a1c64 100644
--- a/below/btrfs/Cargo.toml
+++ b/below/btrfs/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below-btrfs"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "A crate for reading btrfs"
@@ -11,7 +11,7 @@ repository = "https://github.com/facebookincubator/below"
 license = "Apache-2.0"
 
 [dependencies]
-common = { package = "below-common", version = "0.11.0", path = "../common" }
+common = { package = "below-common", version = "0.12.0", path = "../common" }
 libc = "0.2.186"
 nix = { version = "0.31.3", features = ["dir", "event", "hostname", "inotify", "ioctl", "mman", "mount", "net", "poll", "ptrace", "reboot", "resource", "sched", "signal", "term", "time", "user", "zerocopy"] }
 openat = "0.1.21"
diff --git a/below/cgroupfs/Cargo.toml b/below/cgroupfs/Cargo.toml
index 5b8a0642..a20a35c6 100644
--- a/below/cgroupfs/Cargo.toml
+++ b/below/cgroupfs/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "cgroupfs"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "A crate for reading cgroupv2 data"
@@ -12,8 +12,8 @@ license = "Apache-2.0"
 
 [dependencies]
 anyhow = "1.0.104"
-below-vmlinux = { version = "0.11.0", path = "../vmlinux" }
-common = { package = "below-common", version = "0.11.0", path = "../common" }
+below-vmlinux = { version = "0.12.0", path = "../vmlinux" }
+common = { package = "below-common", version = "0.12.0", path = "../common" }
 libbpf-rs = { version = "0.27.2", default-features = false }
 libc = "0.2.186"
 nix = { version = "0.31.3", features = ["dir", "event", "hostname", "inotify", "ioctl", "mman", "mount", "net", "poll", "ptrace", "reboot", "resource", "sched", "signal", "term", "time", "user", "zerocopy"] }
@@ -27,7 +27,7 @@ paste = "1.0.14"
 tempfile = "3.27.0"
 
 [build-dependencies]
-below-vmlinux = { version = "0.11.0", path = "../vmlinux" }
+below-vmlinux = { version = "0.12.0", path = "../vmlinux" }
 bindgen = { version = "0.72.1", features = ["logging", "prettyplease", "runtime"], default-features = false }
 libbpf-cargo = { version = "0.27.2", default-features = false }
 
diff --git a/below/common/Cargo.toml b/below/common/Cargo.toml
index d86fcbce..070bdaa6 100644
--- a/below/common/Cargo.toml
+++ b/below/common/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below-common"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "Common below code"
diff --git a/below/config/Cargo.toml b/below/config/Cargo.toml
index 9bb500c7..c6b822bf 100644
--- a/below/config/Cargo.toml
+++ b/below/config/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below-config"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "Configurations for below"
@@ -11,9 +11,9 @@ license = "Apache-2.0"
 
 [dependencies]
 anyhow = "1.0.104"
-btrfs = { package = "below-btrfs", version = "0.11.0", path = "../btrfs" }
-cgroupfs = { version = "0.11.0", path = "../cgroupfs" }
-procfs = { package = "fb_procfs", version = "0.11.0", path = "../procfs" }
+btrfs = { package = "below-btrfs", version = "0.12.0", path = "../btrfs" }
+cgroupfs = { version = "0.12.0", path = "../cgroupfs" }
+procfs = { package = "fb_procfs", version = "0.12.0", path = "../procfs" }
 serde = { version = "1.0.229", features = ["derive", "rc"] }
 toml = { version = "1.1.8", features = ["preserve_order"] }
 
diff --git a/below/dump/Cargo.toml b/below/dump/Cargo.toml
index 03eaa887..78777b47 100644
--- a/below/dump/Cargo.toml
+++ b/below/dump/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below-dump"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "Dump crate for below"
@@ -11,16 +11,16 @@ license = "Apache-2.0"
 
 [dependencies]
 anyhow = "1.0.104"
-below_derive = { version = "0.11.0", path = "../below_derive" }
+below_derive = { version = "0.12.0", path = "../below_derive" }
 clap = { version = "4.6.2", features = ["derive", "env", "string", "unicode", "wrap_help"] }
-common = { package = "below-common", version = "0.11.0", path = "../common" }
+common = { package = "below-common", version = "0.12.0", path = "../common" }
 enum-iterator = "2.3.0"
-model = { package = "below-model", version = "0.11.0", path = "../model" }
+model = { package = "below-model", version = "0.12.0", path = "../model" }
 regex = "1.13.1"
-render = { package = "below-render", version = "0.11.0", path = "../render" }
+render = { package = "below-render", version = "0.12.0", path = "../render" }
 serde_json = { version = "1.0.154", features = ["alloc", "float_roundtrip", "raw_value", "unbounded_depth"] }
 slog = { version = "2.8.2", features = ["max_level_trace", "nested-values"] }
-store = { package = "below-store", version = "0.11.0", path = "../store" }
+store = { package = "below-store", version = "0.12.0", path = "../store" }
 toml = { version = "1.1.8", features = ["preserve_order"] }
 
 [dev-dependencies]
diff --git a/below/ethtool/Cargo.toml b/below/ethtool/Cargo.toml
index f1e4a8f1..5ae644d2 100644
--- a/below/ethtool/Cargo.toml
+++ b/below/ethtool/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below-ethtool"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "ethtool crate for below"
diff --git a/below/gpu_stats/Cargo.toml b/below/gpu_stats/Cargo.toml
index 8ecf7061..7561c79f 100644
--- a/below/gpu_stats/Cargo.toml
+++ b/below/gpu_stats/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below-gpu-stats"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "GPU stats crate for below"
@@ -10,5 +10,5 @@ repository = "https://github.com/facebookincubator/below"
 license = "Apache-2.0"
 
 [dependencies]
-common = { package = "below-common", version = "0.11.0", path = "../common" }
+common = { package = "below-common", version = "0.12.0", path = "../common" }
 serde = { version = "1.0.229", features = ["derive", "rc"] }
diff --git a/below/model/Cargo.toml b/below/model/Cargo.toml
index 8a150878..821f9762 100644
--- a/below/model/Cargo.toml
+++ b/below/model/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below-model"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "Model crate for below"
@@ -12,22 +12,22 @@ license = "Apache-2.0"
 [dependencies]
 anyhow = "1.0.104"
 async-trait = "0.1.92"
-below_derive = { version = "0.11.0", path = "../below_derive" }
-btrfs = { package = "below-btrfs", version = "0.11.0", path = "../btrfs" }
-cgroupfs = { version = "0.11.0", path = "../cgroupfs" }
-common = { package = "below-common", version = "0.11.0", path = "../common" }
+below_derive = { version = "0.12.0", path = "../below_derive" }
+btrfs = { package = "below-btrfs", version = "0.12.0", path = "../btrfs" }
+cgroupfs = { version = "0.12.0", path = "../cgroupfs" }
+common = { package = "below-common", version = "0.12.0", path = "../common" }
 enum-iterator = "2.3.0"
-ethtool = { package = "below-ethtool", version = "0.11.0", path = "../ethtool" }
-gpu-stats = { package = "below-gpu-stats", version = "0.11.0", path = "../gpu_stats" }
+ethtool = { package = "below-ethtool", version = "0.12.0", path = "../ethtool" }
+gpu-stats = { package = "below-gpu-stats", version = "0.12.0", path = "../gpu_stats" }
 hostname = "0.4.2"
 os_info = "3.15.0"
-procfs = { package = "fb_procfs", version = "0.11.0", path = "../procfs" }
+procfs = { package = "fb_procfs", version = "0.12.0", path = "../procfs" }
 regex = "1.13.1"
-resctrlfs = { version = "0.11.0", path = "../resctrlfs" }
+resctrlfs = { version = "0.12.0", path = "../resctrlfs" }
 serde = { version = "1.0.229", features = ["derive", "rc"] }
 serde_json = { version = "1.0.154", features = ["alloc", "float_roundtrip", "raw_value", "unbounded_depth"] }
 slog = { version = "2.8.2", features = ["max_level_trace", "nested-values"] }
-tc = { package = "below-tc", version = "0.11.0", path = "../tc" }
+tc = { package = "below-tc", version = "0.12.0", path = "../tc" }
 
 [dev-dependencies]
 futures = { version = "0.3.34", features = ["async-await", "compat"] }
diff --git a/below/procfs/Cargo.toml b/below/procfs/Cargo.toml
index 1f8eaf18..87db513a 100644
--- a/below/procfs/Cargo.toml
+++ b/below/procfs/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "fb_procfs"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "A crate for reading procfs"
@@ -11,7 +11,7 @@ repository = "https://github.com/facebookincubator/below"
 license = "Apache-2.0"
 
 [dependencies]
-common = { package = "below-common", version = "0.11.0", path = "../common" }
+common = { package = "below-common", version = "0.12.0", path = "../common" }
 libc = "0.2.186"
 nix = { version = "0.31.3", features = ["dir", "event", "hostname", "inotify", "ioctl", "mman", "mount", "net", "poll", "ptrace", "reboot", "resource", "sched", "signal", "term", "time", "user", "zerocopy"] }
 openat = "0.1.21"
diff --git a/below/render/Cargo.toml b/below/render/Cargo.toml
index c21c61bd..95d7f24a 100644
--- a/below/render/Cargo.toml
+++ b/below/render/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below-render"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "Render crate for below"
@@ -10,5 +10,5 @@ repository = "https://github.com/facebookincubator/below"
 license = "Apache-2.0"
 
 [dependencies]
-common = { package = "below-common", version = "0.11.0", path = "../common" }
-model = { package = "below-model", version = "0.11.0", path = "../model" }
+common = { package = "below-common", version = "0.12.0", path = "../common" }
+model = { package = "below-model", version = "0.12.0", path = "../model" }
diff --git a/below/resctrlfs/Cargo.toml b/below/resctrlfs/Cargo.toml
index df6009dd..17b4c2ed 100644
--- a/below/resctrlfs/Cargo.toml
+++ b/below/resctrlfs/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "resctrlfs"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "A crate for reading resctrl fs data"
@@ -11,7 +11,7 @@ repository = "https://github.com/facebookincubator/below"
 license = "Apache-2.0"
 
 [dependencies]
-common = { package = "below-common", version = "0.11.0", path = "../common" }
+common = { package = "below-common", version = "0.12.0", path = "../common" }
 nix = { version = "0.31.3", features = ["dir", "event", "hostname", "inotify", "ioctl", "mman", "mount", "net", "poll", "ptrace", "reboot", "resource", "sched", "signal", "term", "time", "user", "zerocopy"] }
 openat = "0.1.21"
 serde = { version = "1.0.229", features = ["derive", "rc"] }
diff --git a/below/src/main.rs b/below/src/main.rs
index 6d8b8bc0..8cf7a006 100644
--- a/below/src/main.rs
+++ b/below/src/main.rs
@@ -90,7 +90,7 @@ open_source_shim!();
 static LIVE_REMOTE_MAX_LATENCY_SEC: u64 = 10;
 
 #[derive(Debug, Parser)]
-#[clap(version = option_env!("BELOW_VERSION").unwrap_or(env!("CARGO_PKG_VERSION")))]
+#[clap(version)]
 struct Opt {
     #[clap(long, value_parser, default_value = config::BELOW_DEFAULT_CONF)]
     config: PathBuf,
diff --git a/below/store/Cargo.toml b/below/store/Cargo.toml
index 375eb592..81518467 100644
--- a/below/store/Cargo.toml
+++ b/below/store/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below-store"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "Store crate for below"
@@ -13,11 +13,11 @@ license = "Apache-2.0"
 anyhow = "1.0.104"
 bitflags = { version = "2.13.2", features = ["serde", "std"], default-features = false }
 bytes = { version = "1.12.1", features = ["serde"] }
-common = { package = "below-common", version = "0.11.0", path = "../common" }
+common = { package = "below-common", version = "0.12.0", path = "../common" }
 humantime = "2.4.0"
 maplit = "1.0"
 memmap2 = "0.9.11"
-model = { package = "below-model", version = "0.11.0", path = "../model" }
+model = { package = "below-model", version = "0.12.0", path = "../model" }
 nix = { version = "0.31.3", features = ["dir", "event", "hostname", "inotify", "ioctl", "mman", "mount", "net", "poll", "ptrace", "reboot", "resource", "sched", "signal", "term", "time", "user", "zerocopy"] }
 serde = { version = "1.0.229", features = ["derive", "rc"] }
 serde_cbor = "0.11.2"
diff --git a/below/tc/Cargo.toml b/below/tc/Cargo.toml
index d31ec856..0ee0f0b8 100644
--- a/below/tc/Cargo.toml
+++ b/below/tc/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below-tc"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "TC crate for below"
diff --git a/below/view/Cargo.toml b/below/view/Cargo.toml
index 9731dfae..e2d75e62 100644
--- a/below/view/Cargo.toml
+++ b/below/view/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below-view"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "View crate for below"
@@ -12,19 +12,19 @@ license = "Apache-2.0"
 [dependencies]
 anyhow = "1.0.104"
 chrono = { version = "0.4.45", features = ["clock", "serde", "std"], default-features = false }
-common = { package = "below-common", version = "0.11.0", path = "../common" }
+common = { package = "below-common", version = "0.12.0", path = "../common" }
 crossterm = { version = "0.29", features = ["event-stream", "serde"] }
 cursive = { version = "0.21.1", features = ["crossterm-backend"], default-features = false }
 enum-iterator = "2.3.0"
 humantime = "2.4.0"
 itertools = "0.15.0"
 libc = "0.2.186"
-model = { package = "below-model", version = "0.11.0", path = "../model" }
-procfs = { package = "fb_procfs", version = "0.11.0", path = "../procfs" }
-render = { package = "below-render", version = "0.11.0", path = "../render" }
+model = { package = "below-model", version = "0.12.0", path = "../model" }
+procfs = { package = "fb_procfs", version = "0.12.0", path = "../procfs" }
+render = { package = "below-render", version = "0.12.0", path = "../render" }
 serde = { version = "1.0.229", features = ["derive", "rc"] }
 slog = { version = "2.8.2", features = ["max_level_trace", "nested-values"] }
-store = { package = "below-store", version = "0.11.0", path = "../store" }
+store = { package = "below-store", version = "0.12.0", path = "../store" }
 toml = { version = "1.1.8", features = ["preserve_order"] }
 
 [dev-dependencies]
diff --git a/below/vmlinux/Cargo.toml b/below/vmlinux/Cargo.toml
index 50117eb6..0577f1a1 100644
--- a/below/vmlinux/Cargo.toml
+++ b/below/vmlinux/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "below-vmlinux"
-version = "0.11.0"
+version = "0.12.0"
 authors = ["Meta Platforms, Inc. and affiliates"]
 edition = "2024"
 description = "Vendored kernel BTF (vmlinux.h) shared by below's BPF programs"
diff --git a/docs/building.md b/docs/building.md
index bba52232..528430ba 100644
--- a/docs/building.md
+++ b/docs/building.md
@@ -45,13 +45,14 @@ cargo test
 # Debian packages
 
 `scripts/package_deb.sh <target triple>` packages a release build as
-`target/<triple>/debian/below_<version>_<arch>.deb`. The package installs
+`target/<triple>/debian/below_<version>-1_<arch>.deb`. The package installs
 `/usr/bin/below` and enables and starts `below.service`, which records to
 `/var/log/below/store`.
 
-Tagged releases publish amd64 and arm64 packages, built on Ubuntu 22.04, and
+Pushing a `v<version>` tag that matches the version in `below/Cargo.toml`
+publishes a release with amd64 and arm64 packages, built on Ubuntu 22.04, and
 the matching binaries. Install one with:
 
 ```shell
-sudo apt install ./below_<version>_amd64.deb
+sudo apt install ./below_<version>-1_amd64.deb
 ```
diff --git a/scripts/package_deb.sh b/scripts/package_deb.sh
index 1ff8f364..be188d64 100755
--- a/scripts/package_deb.sh
+++ b/scripts/package_deb.sh
@@ -22,7 +22,4 @@ set -eu
 
 cd "$(dirname "$(realpath "$0")")"/..
 
-triple=$1
-version=$(scripts/version.sh)
-
-cargo deb --package below --no-build --target "$triple" --deb-version "$version"
+cargo deb --package below --no-build --target "$1"
diff --git a/scripts/test_deb.sh b/scripts/test_deb.sh
index 7d21e0b5..de868b16 100755
--- a/scripts/test_deb.sh
+++ b/scripts/test_deb.sh
@@ -42,5 +42,6 @@ done
 docker cp "$deb" "$container:/root/below.deb"
 docker exec "$container" apt-get install -y -qq /root/below.deb
 docker exec "$container" below --version
-test "$(docker exec "$container" below --version)" = "below $(dpkg-deb --field "$deb" Version)"
+version=$(dpkg-deb --field "$deb" Version)
+test "$(docker exec "$container" below --version)" = "below ${version%-*}"
 docker exec "$container" systemctl is-enabled below
diff --git a/scripts/version.sh b/scripts/version.sh
deleted file mode 100755
index 8cef9df2..00000000
--- a/scripts/version.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) Facebook, Inc. and its affiliates.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-# Print the version for a build of this checkout. Commits since the
-# v<crate version> tag sort after that release and before the next.
-
-set -eu
-
-cd "$(dirname "$(realpath "$0")")"/..
-
-crate_version=$(sed -n 's/^version = "\(.*\)"/\1/p' below/Cargo.toml | head -1)
-describe=$(git describe --tags --match "v$crate_version" --long --abbrev=12)
-since=$(sed -E 's/^.*-([0-9]+)-g[0-9a-f]+$/\1/' <<<"$describe")
-commit=$(sed -E 's/^.*-g([0-9a-f]+)$/\1/' <<<"$describe")
-if [ "$since" = 0 ]; then
-  echo "$crate_version"
-else
-  echo "$crate_version+git$since.$commit"
-fi

From 9dd0b5b5c3f24c5aeccef0ca5fdaa7c13e779eea Mon Sep 17 00:00:00 2001
From: Giles Westwood <201443+gilesw@users.noreply.github.com>
Date: Wed, 28 Oct 2026 17:42:02 +0000
Subject: [PATCH 4/5] Add the commit to --version for builds that aren't a
 release

Like ripgrep, build.rs passes the short commit hash to the build and
--version prints "below 0.12.0 (rev <hash>)". When HEAD is the
v<version> tag the hash is left out, so release builds print
"below 0.12.0".
---
 below/build.rs      | 29 +++++++++++++++++++++++++++++
 below/src/main.rs   | 10 +++++++++-
 scripts/test_deb.sh |  8 ++++++--
 3 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/below/build.rs b/below/build.rs
index 83032e5f..c728aa7b 100644
--- a/below/build.rs
+++ b/below/build.rs
@@ -15,12 +15,15 @@
 use std::env;
 use std::ffi::OsString;
 use std::path::PathBuf;
+use std::process::Command;
 
 use libbpf_cargo::SkeletonBuilder;
 
 const SRC: &str = "./src/bpf/exitstat.bpf.c";
 
 fn main() {
+    set_git_revision_hash();
+
     let mut out =
         PathBuf::from(env::var_os("OUT_DIR").expect("OUT_DIR must be set in build script"));
     out.push("exitstat.skel.rs");
@@ -45,3 +48,29 @@ fn main() {
         "In order to build without vendored dependencies please disable default features"
     );
 }
+
+/// Make the commit available to the build as `BELOW_BUILD_GIT_HASH`, unless
+/// HEAD is the `v<version>` release tag.
+fn set_git_revision_hash() {
+    let Some(rev) = git(&["rev-parse", "--short=10", "HEAD"]) else {
+        return;
+    };
+    let branch = git(&["symbolic-ref", "-q", "HEAD"]);
+    for git_ref in std::iter::once("HEAD").chain(branch.as_deref()) {
+        if let Some(path) = git(&["rev-parse", "--git-path", git_ref]) {
+            println!("cargo:rerun-if-changed={path}");
+        }
+    }
+    let tag = format!("v{}", env::var("CARGO_PKG_VERSION").unwrap());
+    let tags = git(&["tag", "--points-at", "HEAD"]).unwrap_or_default();
+    if !tags.lines().any(|t| t == tag) {
+        println!("cargo:rustc-env=BELOW_BUILD_GIT_HASH={rev}");
+    }
+}
+
+fn git(args: &[&str]) -> Option<String> {
+    let output = Command::new("git").args(args).output().ok()?;
+    let stdout = String::from_utf8(output.stdout).ok()?;
+    let stdout = stdout.trim();
+    (output.status.success() && !stdout.is_empty()).then(|| stdout.to_string())
+}
diff --git a/below/src/main.rs b/below/src/main.rs
index 8cf7a006..138affa0 100644
--- a/below/src/main.rs
+++ b/below/src/main.rs
@@ -89,8 +89,16 @@ open_source_shim!();
 
 static LIVE_REMOTE_MAX_LATENCY_SEC: u64 = 10;
 
+/// The crate version, with the commit for builds that aren't a release tag.
+fn version() -> String {
+    match option_env!("BELOW_BUILD_GIT_HASH") {
+        None => env!("CARGO_PKG_VERSION").to_string(),
+        Some(hash) => format!("{} (rev {hash})", env!("CARGO_PKG_VERSION")),
+    }
+}
+
 #[derive(Debug, Parser)]
-#[clap(version)]
+#[clap(version = version())]
 struct Opt {
     #[clap(long, value_parser, default_value = config::BELOW_DEFAULT_CONF)]
     config: PathBuf,
diff --git a/scripts/test_deb.sh b/scripts/test_deb.sh
index de868b16..b5c20e96 100755
--- a/scripts/test_deb.sh
+++ b/scripts/test_deb.sh
@@ -41,7 +41,11 @@ done
 # Not /tmp: systemd may mount a tmpfs over it after docker cp has written there.
 docker cp "$deb" "$container:/root/below.deb"
 docker exec "$container" apt-get install -y -qq /root/below.deb
-docker exec "$container" below --version
 version=$(dpkg-deb --field "$deb" Version)
-test "$(docker exec "$container" below --version)" = "below ${version%-*}"
+reported=$(docker exec "$container" below --version)
+echo "$reported"
+case $reported in
+  "below ${version%-*}" | "below ${version%-*} (rev "*")") ;;
+  *) echo "below --version does not match the package version $version" >&2; exit 1 ;;
+esac
 docker exec "$container" systemctl is-enabled below

From 03a60efde3a99df3f0bfb9f7c68907c26e6cdfa4 Mon Sep 17 00:00:00 2001
From: Giles Westwood <201443+gilesw@users.noreply.github.com>
Date: Wed, 28 Oct 2026 18:03:58 +0000
Subject: [PATCH 5/5] Add mise.toml with version, deb and lint tasks

mise run version <version> runs cargo set-version --workspace, which
bumps every crate and the internal dependency versions autocargo writes
next to each path. cargo-deb is pinned to the same version in CI.
---
 .github/workflows/build.yml |  4 ++--
 docs/building.md            |  7 ++++---
 mise.toml                   | 31 +++++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+), 5 deletions(-)
 create mode 100644 mise.toml

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5f320def..a4e55bb0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -46,7 +46,7 @@ jobs:
         with:
           components: rustfmt
       - uses: Swatinem/rust-cache@v2
-      - run: cargo install --locked cargo-deb
+      - run: cargo install --locked cargo-deb@3.8.0
       - run: cargo build --release --locked --package below --target "$TARGET"
       # Skip tests that require host to have cgroup2
       - run: >
@@ -61,7 +61,7 @@ jobs:
         id: package
         run: |
           scripts/package_deb.sh "$TARGET"
-          package=$(ls target/$TARGET/debian/below_*.deb)
+          package=$(ls "target/$TARGET"/debian/below_*.deb)
           test "$(dpkg-deb --field "$package" Architecture)" = "${{ matrix.debarch }}"
           echo "path=$package" >> "$GITHUB_OUTPUT"
       - run: scripts/test_deb.sh "${{ steps.package.outputs.path }}" ubuntu:22.04
diff --git a/docs/building.md b/docs/building.md
index 528430ba..c2a97e3c 100644
--- a/docs/building.md
+++ b/docs/building.md
@@ -49,9 +49,10 @@ cargo test
 `/usr/bin/below` and enables and starts `below.service`, which records to
 `/var/log/below/store`.
 
-Pushing a `v<version>` tag that matches the version in `below/Cargo.toml`
-publishes a release with amd64 and arm64 packages, built on Ubuntu 22.04, and
-the matching binaries. Install one with:
+To release, run `mise run version <version>` to set the version of every
+workspace crate, merge that, then push a `v<version>` tag. The tag must match
+the version in `below/Cargo.toml`. The release has amd64 and arm64 packages,
+built on Ubuntu 22.04, and the matching binaries. Install one with:
 
 ```shell
 sudo apt install ./below_<version>-1_amd64.deb
diff --git a/mise.toml b/mise.toml
new file mode 100644
index 00000000..7db1241c
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,31 @@
+# Task automation. `mise tasks` lists them. below only builds on Linux.
+
+[tools]
+actionlint = "1.7.12"
+shellcheck = "0.11.0"
+"cargo:cargo-edit" = "0.13.14"
+"cargo:cargo-deb" = "3.8.0"
+
+[tasks.version]
+description = "Set the version of every workspace crate: mise run version 0.12.1"
+usage = 'arg "<version>"'
+run = 'cargo set-version --workspace "${usage_version?}"'
+
+[tasks.deb]
+description = "Build below and package it as a .deb for this machine's architecture"
+run = [
+  'cargo build --release --locked --package below --target "$(uname -m)-unknown-linux-gnu"',
+  'scripts/package_deb.sh "$(uname -m)-unknown-linux-gnu"',
+]
+
+[tasks."test:deb"]
+description = "Install the newest .deb in an Ubuntu systemd container and check it"
+run = 'scripts/test_deb.sh "$(ls -t target/*/debian/below_*.deb | head -1)"'
+
+[tasks."lint:actions"]
+description = "Lint the release workflows"
+run = "actionlint .github/workflows/build.yml .github/workflows/release.yml"
+
+[tasks."lint:scripts"]
+description = "Run ShellCheck on the packaging scripts"
+run = "shellcheck scripts/package_deb.sh scripts/test_deb.sh"