Been using chezmoi for a while now and mostly happy with it. Managing most of my work and personal configs/dotfiles for PowerShell Core, bash, and zsh across Windows, Mac, and Linux.

The only problem I've run into is that while chezmoi supports tracking files/directories as read-only, once they are created they can't be updated anymore because chezmoi isn't smart enough to swap them to writable and back.