A third-party action is a reusable automation step used in a CI/CD workflow, but maintained outside your own repository. In systems like GitHub Actions, it behaves like executable dependency code: when a workflow runs, it can fetch and execute code from another project, not just local scripts.
This matters because the action may run with repository secrets, build credentials, and workflow tokens. If the upstream action is compromised, republished, or referenced through a mutable tag, the next build can execute unsafe code without changing your own repository. Defenders reduce this risk by pinning actions to a full commit SHA, limiting workflow permissions, reviewing dependencies regularly, and monitoring upstream changes before trusting updates.