I just do this. Easy
What secrets? I generally don’t copy them, but you could manually. For example I use the same ssh keypair on two machines, but I generally don’t.
https://github.com/twpayne/dotfiles/blob/master/home/dot_zsh...
This means that: 1. My secrets are safely stored in my password manager so I can share my dotfiles. 2. When I update the secret in my password manager it automatically gets updated in my dotfiles when I run `chezmoi apply`.
I store them in Bitwarden not in dotfiles
I… am not sure what that has to do with scripts?