You seem to have answered your own question. One base, "girlfriend", since that is what the affix "s" is added to, at least judging from the meaning. Morphologically, I guess it is not entirely obvious that "s" is not affixed to "friend", since we have the compound "musk oxen" rather than "muskoxes", where the form of the affix is determined by the second part of the compound.
By definition, compounds have more than one base: mice-killer is formed from MOUSE and KILL. Unlike Noun-Verb+er compounds, most of them are opaque and the relation between the two vary. There is a long tradition giving names to these different cases. For example, one of the oldest:
tatpurusa => blackboard: 1 head = BOARD, 1 modifier = BLACK
dvandva => bittersweet: 2 heads = BITTER & SWEET
bahuvrihi => chatterbox : no head (as a chatterbox is neither chatter nor a box)
A base is a lexeme used in a derivation usually for both the semantic and the phonological part of the construction. In girlfriend both the lexemes GIRL and FRIEND are used to build the derived word.
friendis the head. I think
stemis a more correct substitution here.