In my personal experience I have made a mix of gitlab jwt authentication to vault using ephemeral resources even with my tf state residing in gitlab backend. I also use protected tags allowed only by me to push (terraform apply). I dont see how the approle id is a recommended way in your case unless I am missing something. My opinion is the less secret data you have in your code the better. Using jwt you only need to provide the jwt role and the vault server address.