docs/data/reusables/github-actions/disabling-github-actions.md

By default, {% ifversion ghes or ghae %}after {% data variables.product.prodname_actions %} is enabled on {% data variables.product.product_location %}, it{% elsif fpt %}{% data variables.product.prodname_actions %}{% endif %} is enabled on all repositories and organizations. You can choose to disable {% data variables.product.prodname_actions %} or limit them to private actions only, which means that people can only use actions that exist in your repository.