🌱 ci: compare go-apidiff against the PR merge base

.github/workflows/go-apidiff.yaml

@@ -16,8 +16,46 @@ jobs:
       with:
         go-version-file: go.mod
 
+    - name: Determine comparison base
+      id: base
+      env:
+        PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+        MG_BASE_SHA: ${{ github.event.merge_group.base_sha }}
+      run: |
+        set -euo pipefail
+        if [[ -n "${PR_BASE_SHA}" ]]; then
+          # Compare the PR head against its merge base so the check only
+          # covers changes introduced by the PR itself. Comparing against the
+          # base branch tip instead attributes API changes from PRs that merged
+          # after this PR was created to this PR (e.g. when a label change
+          # re-triggers the workflow after the base branch has advanced).
+          # go-apidiff compares base-ref against the working tree, and
+          # actions/checkout checks out the synthetic merge commit for
+          # pull_request events. That merge commit contains base branch changes
+          # made after the merge base, so they would still leak into the head
+          # side of the comparison. Fetch the PR head explicitly (the merge
+          # checkout may not include it) and check it out so both comparison
+          # endpoints are immutable git objects.
+          git fetch --no-tags origin "refs/pull/${PR_NUMBER}/head"
+          git checkout --quiet "${PR_HEAD_SHA}"
+          BASE_REF="$(git merge-base "${PR_BASE_SHA}" "${PR_HEAD_SHA}")"
+        else
+          # merge_group events compare against the base of the merge group.
+          BASE_REF="${MG_BASE_SHA}"
+        fi
+        if [[ -z "${BASE_REF}" ]]; then
+          echo "Unable to determine comparison base" >&2
+          exit 1
+        fi
+        echo "Using comparison base: ${BASE_REF}"
+        echo "ref=${BASE_REF}" >> "${GITHUB_OUTPUT}"
+
     - uses: joelanford/go-apidiff@main
       id: check-api
+      with:
+        base-ref: ${{ steps.base.outputs.ref }}
       continue-on-error: true
 
     - name: Check for override label