config

const (
	// ColorAuto enables colorized diagnostic output on a tty only.
	ColorAuto = "auto"

	// ColorAlways colorized diagnostic output without checking for a terminal.
	ColorAlways = "always"

	// ColorNever disables colorized diagnostic output.
	ColorNever = "never"
)

What -color can be told. "auto" is the only one that looks at where it is writing.

const (
	FailNever   = "never"
	FailError   = "error"
	FailWarning = "warning"
)

What -fail-on can be told: the least serious diagnostic that still makes the command exit non-zero.

"never" is the default because a scan that emits warnings is the ordinary case - a codebase with nothing to say about it is the exception - and a command that failed the build over one would mostly teach people to stop reading it.

const (
	FormatAuto = "auto"
	FormatJSON = "json"
	FormatYAML = "yaml"
)

What -format can be told.

"auto" reads the extension of -output, or defaults to JSON, which is what a document going to standard output does.