I think this token is so that you can get tarballs for private repos, but this won't work if there is a mix of GH and GH:E repositories.  If the token is wrong, the call fails even for public repos.  In order to get optimal support for GH:E, we'd probably need to extend librarian-puppet to map Github domains to tokens, rather than accept one global token.