Deploy /etc/puppet as a role account
On our puppet master (alberti.tpo), the post-receive git hook deploys the tor-puppet repo in /etc/puppet as the user pushing. As long as umask is correct and the stars are aligned, things are good. Sometimes files end up with 0644 when we need them to be 0664 in order for other accounts (in group 'adm') to be able to change existing files.
Start using a role account instead of individual admin accounts for deploying to /etc/puppet.
To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information