@@ -259,9 +259,19 @@ function git(repoRoot, args) {
 	return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8", maxBuffer: 20 * 1024 * 1024 })
 }
 
+// GitHub checks out the synthetic pull request merge commit, but `pull_request.base.sha` is frozen at
+// event-creation time. When main advances afterwards, that stale base attributes unrelated upstream
+// lines to the pull request. The merge commit's first parent is the base actually merged into.
+export function resolvePullRequestBase(repoRoot, baseSha, headSha) {
+	const parents = git(repoRoot, ["rev-list", "--parents", "-n", "1", headSha]).trim().split(/\s+/).slice(1)
+	if (parents.length < 2) return baseSha
+	return parents[0]
+}
+
 export function selectFromGit(repoRoot, baseSha, headSha) {
 	validateSha(baseSha, "base SHA")
 	validateSha(headSha, "head SHA")
+	baseSha = resolvePullRequestBase(repoRoot, baseSha, headSha)
 	const mergeBase = git(repoRoot, ["merge-base", baseSha, headSha]).trim()
 	const nameStatus = git(repoRoot, ["diff", "--name-status", "-z", "--find-renames", `${mergeBase}...${headSha}`])
 	const entries = parseNameStatus(nameStatus)
 
@@ -95,6 +95,86 @@ describe("mutation testing workflow", () => {
 	})
 })
 
+function createSyntheticPullRequestRepository() {
+	const repository = fs.mkdtempSync(path.join(os.tmpdir(), "stryker-diff-revision-"))
+	const run = (...args) => execFileSync("git", args, { cwd: repository, encoding: "utf8" }).trim()
+	const write = (filePath, contents) => {
+		fs.mkdirSync(path.join(repository, path.dirname(filePath)), { recursive: true })
+		fs.writeFileSync(path.join(repository, filePath), contents)
+	}
+
+	run("init", "--quiet", "--initial-branch", "main")
+	run("config", "user.email", "[email protected]")
+	run("config", "user.name", "Gate")
+	run("config", "commit.gpgsign", "false")
+
+	write("packages/core/src/unrelated.ts", "export const unrelated = () => 1\n")
+	write("packages/core/src/feature.ts", "export const feature = () => 1\n")
+	run("add", ".")
+	run("commit", "--quiet", "-m", "initial")
+	const eventBaseSha = run("rev-parse", "HEAD")
+
+	run("checkout", "--quiet", "-b", "pull-request")
+	write("packages/core/src/feature.ts", "export const feature = () => 2\n")
+	run("add", ".")
+	run("commit", "--quiet", "-m", "pull request change")
+
+	// The upstream change lands after the pull_request event recorded its base SHA, which is what
+	// made the stale event base attribute unrelated main-only lines to the pull request.
+	run("checkout", "--quiet", "main")
+	write("packages/core/src/unrelated.ts", "export const unrelated = () => 99\n")
+	run("add", ".")
+	run("commit", "--quiet", "-m", "unrelated upstream change")
+	const upstreamSha = run("rev-parse", "HEAD")
+
+	run("merge", "--quiet", "--no-ff", "-m", "merge pull request", "pull-request")
+	const mergeSha = run("rev-parse", "HEAD")
+
+	return { repository, eventBaseSha, upstreamSha, mergeSha }
+}
+
+describe("pull request revision selection", () => {
+	it("excludes unrelated upstream files by diffing from the merge commit's first parent", () => {
+		const { repository, eventBaseSha, upstreamSha, mergeSha } = createSyntheticPullRequestRepository()
+
+		// A failed assertion must still remove the temporary repository, or a failing run leaks it.
+		try {
+			const manifest = selectFromGit(repository, eventBaseSha, mergeSha)
+			const changedPaths = manifest.packages.flatMap((entry) => entry.files.map((file) => file.path))
+
+			assert.deepEqual(changedPaths, ["packages/core/src/feature.ts"])
+			assert.equal(manifest.baseSha, upstreamSha)
+			assert.equal(manifest.mergeBase, upstreamSha)
+
+			// Selectors must stay aligned with the checked-out head content.
+			assert.equal(manifest.headSha, mergeSha)
+			assert.deepEqual(
+				manifest.packages.flatMap((entry) => entry.selectors),
+				["src/feature.ts:1-1"],
+			)
+		} finally {
+			fs.rmSync(repository, { recursive: true, force: true })
+		}
+	})
+
+	it("keeps the supplied base for non-merge heads such as manual runs", () => {
+		const { repository, eventBaseSha, upstreamSha } = createSyntheticPullRequestRepository()
+
+		try {
+			const manifest = selectFromGit(repository, eventBaseSha, upstreamSha)
+
+			assert.equal(manifest.baseSha, eventBaseSha)
+			assert.equal(manifest.mergeBase, eventBaseSha)
+			assert.deepEqual(
+				manifest.packages.flatMap((entry) => entry.files.map((file) => file.path)),
+				["packages/core/src/unrelated.ts"],
+			)
+		} finally {
+			fs.rmSync(repository, { recursive: true, force: true })
+		}
+	})
+})
+
 describe("parseNameStatus", () => {
 	it("parses added, modified, and renamed paths", () => {
 		assert.deepEqual(
@@ -475,9 +555,11 @@ describe("selectFromGit", () => {
 			const mergeResultBaseSha = runGit("rev-parse", `${mergeSha}^1`)
 			assert.equal(mergeResultBaseSha, currentBaseSha)
 
+			// A stale base is normalized to the merge's first parent, so the advanced base branch
+			// file is not charged to the pull request.
 			assert.deepEqual(
 				selectFromGit(repo, staleBaseSha, mergeSha).packages[0].files.map(({ path: filePath }) => filePath),
-				["packages/core/src/base.ts", "packages/core/src/pr.ts"],
+				["packages/core/src/pr.ts"],
 			)
 			assert.deepEqual(
 				selectFromGit(repo, mergeResultBaseSha, mergeSha).packages[0].files.map(