Built-in is automatic. User-defined needs an underscore.

Two kinds of substitution, told apart by one character.

Built-in

$PROJECT_ID, $SHORT_SHA, $BRANCH_NAME — resolved automatically, zero declaration.

User-defined

$_REGION — underscore-prefixed, declared in the trigger or YAML.

cloudbuild.yaml

images:
  - '${_REGION}-docker.pkg.dev/${PROJECT_ID}/
     meridian-images/shipment-api:${SHORT_SHA}'

Rule of thumb: tag every image with $SHORT_SHA, never latest — or an incident has no way to answer which commit is actually running.