Fix spawnbackend github cmd (#7819)

.github/workflows/spawn-ephemeral-backend.yml

@@ -3,6 +3,8 @@ name: Spawn Ephemeral Backend
 on:
   issue_comment:
     types: [created]
+  pull_request_review_comment:
+    types: [created]
   workflow_dispatch:
     inputs:
       pr_number:
@@ -11,60 +13,48 @@ on:
         type: number
 
 jobs:
+  determine-commenter:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '/spawnbackend')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '/spawnbackend'))
+    runs-on: ubicloud-standard-2
+    outputs:
+      commenter: ${{ steps.determine-commenter.outputs.commenter }}
+    steps:
+      - name: Determine commenter
+        id: determine-commenter
+        run: |
+          # Work out who wrote the comment / review
+          if [[ "${{ github.event_name }}" == "issue_comment" || \
+                "${{ github.event_name }}" == "pull_request_review_comment" ]]; then
+            COMMENTER="${{ github.event.comment.user.login }}"
+          elif [[ "${{ github.event_name }}" == "pull_request_review" ]]; then
+            COMMENTER="${{ github.event.review.user.login }}"
+          else
+            COMMENTER="${{ github.event.issue.user.login }}"
+          fi
+          echo "commenter=$COMMENTER" >> $GITHUB_OUTPUT
+
+  check-membership:
+    needs: determine-commenter
+    uses: ./.github/workflows/check-org-membership.yml
+    with:
+      commenter: ${{ needs.determine-commenter.outputs.commenter }}
+    secrets:
+      access_token: ${{ secrets.ORG_ACCESS_TOKEN }}
+
   spawn-backend:
+    needs: [determine-commenter, check-membership]
     # Only run on PR comments that contain /spawn-backend, or manual dispatch
     if: |
       github.event_name == 'workflow_dispatch' ||
-      (github.event.issue.pull_request && contains(github.event.comment.body, '/spawn-backend'))
+      (github.event.issue.pull_request && needs.check-membership.outputs.is_member == 'true')
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
       contents: read
 
     steps:
-      - name: Check organization membership
-        if: github.event_name == 'issue_comment'
-        id: check-org-member
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const commenter = context.payload.comment.user.login;
-
-            try {
-              const membership = await github.rest.orgs.checkMembershipForUser({
-                org: 'windmill-labs',
-                username: commenter
-              });
-
-              core.setOutput('is_member', 'true');
-              console.log(`✓ User ${commenter} is a member of windmill-labs`);
-            } catch (error) {
-              core.setOutput('is_member', 'false');
-              console.log(`✗ User ${commenter} is not a member of windmill-labs`);
-            }
-
-      - name: Post unauthorized comment
-        if: |
-          github.event_name == 'issue_comment' &&
-          steps.check-org-member.outputs.is_member == 'false'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: `❌ Unauthorized: Only members of the windmill-labs organization can spawn ephemeral backends.`
-            });
-
-      - name: Fail if not org member
-        if: |
-          github.event_name == 'issue_comment' &&
-          steps.check-org-member.outputs.is_member == 'false'
-        run: |
-          echo "Error: User is not a member of windmill-labs organization"
-          exit 1
-
       - name: Get PR details
         id: pr-details
         uses: actions/github-script@v7