The repository.yaml file holds a Maven GAV to each Forge Plugin.
However, Forge's resolution only retrieves the latest/HEAD revision of a particular Git Branch, ignoring the Maven GAV given in the repository.yaml.

Thus, one must release SNAPSHOT plugin versions in order to be able to bugfix Forge plugins. This is quite contrary to a normal Maven release, where SNAPSHOT versions are not permitted (for example by the release plugin).

So ...

1. Forge only uses HEAD of a branch to find a plugin source code revision
2. Repository.yaml indicates that a particular Maven GAV for a project should be used for the plugin
3. During resolution, Forge ignores the Maven GAV in repository.yaml
4. Maven releases are normally not permitted to contain SNAPSHOTs, but the two facts above requires Forge plugins to be Maven SNAPSHOTs.

It seems that two different (and not particularly coherent) models are used to define Forge's resolution here.